CVE-2026-37233
Possible ATT&CK Techniques 1AI
T1528 · Steal Application Access TokenGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-37233
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. The equality function eq_xapp_ric_gen_id() in src/ric/iApp/xapp_ric_id.c compares m0->xapp_id against itself (m0->xapp_id) instead of the other argument (m1->xapp_id), effectively ignoring the xApp identity dimension. A malicious xApp connected to the iApp (port 36422) can delete any other xApp's subscriptions by sending an E42_RIC_SUBSCRIPTION_DELETE_REQUEST with a matching ric_gen_id. This breaks multi-tenant isolation in any deployment with multiple xApps sharing the same RIC.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
FlexRIC 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FlexRIC是Mosaic5G开源的一个 RAN 智能控制器。 FlexRIC v2.0.0版本存在安全漏洞，该漏洞源于iApp的xApp隔离机制中授权绕过，比较函数错误地将xapp_id与自身比较而非其他参数，可能导致恶意xApp删除其他xApp的订阅破坏多租户隔离。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2026-37233
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-37233
请登录查看更多情报信息。
News Coverage for CVE-2026-37233 (1)
Other References for CVE-2026-37233 (1)
Same Patch Batch · n/a · 2026-06-01 · 35 CVEs total
| CVE-2026-10273 | 7.3 HIGH | php-censor Webhook Endpoint GitBuild.php os command injection |
| CVE-2026-10240 | 6.3 MEDIUM | JeecgBoot test server-side request forgery |
| CVE-2026-10239 | 6.3 MEDIUM | JeecgBoot edit WordUtil.addImage server-side request forgery |
| CVE-2026-10229 | 5.3 MEDIUM | Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_meshes heap-based overflow |
| CVE-2026-10230 | 5.3 MEDIUM | Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_animations heap-based overflow |
| CVE-2026-10232 | 5.3 MEDIUM | Assimp ASE File scene.cpp ~aiNode use after free |
| CVE-2026-10231 | 5.3 MEDIUM | Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp extract_anim_value heap-based overflow |
| CVE-2026-10275 | 5.0 MEDIUM | OpenSC pkcs11-tool Key Generation pkcs11-tool.c test_kpgen_certwrite buffer overflow |
| CVE-2026-10294 | 4.3 MEDIUM | PackageKit API pk-transaction.c g_file_test improper authorization |
| CVE-2026-10300 | 3.7 LOW | SGLang Inference HTTP Endpoint lora_manager.py assertion |
| CVE-2026-10233 | 3.3 LOW | Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_sequence_infos out-of-bounds |
| CVE-2026-37226 | FlexRIC 安全漏洞 | |
| CVE-2025-70099 | lwext4 安全漏洞 | |
| CVE-2026-37234 | FlexRIC 安全漏洞 | |
| CVE-2026-37230 | FlexRIC 安全漏洞 | |
| CVE-2026-37229 | FlexRIC 安全漏洞 | |
| CVE-2026-37231 | FlexRIC 安全漏洞 | |
| CVE-2026-37225 | FlexRIC 安全漏洞 | |
| CVE-2026-37220 | FlexRIC 安全漏洞 | |
| CVE-2025-60485 | GPAC 安全漏洞 |
Showing top 20 of 35 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: n/a
V. Comments for CVE-2026-37233
No comments yet