Security readout for executives and security teams
Plain-English summary
A remotely reachable flaw in the O-RAN E2T I-Release can crash a processing thread while updating a Prometheus metric, disrupting service availability. The published CVSS score is 7.5 (high). The source bundle does not identify affected versions, a confirmed patch, or evidence of active exploitation.
Executive priority
Prioritize rapid exposure identification because successful triggering could interrupt a telecom control-plane component without authentication. Escalate internet-facing or broadly reachable deployments first. The incomplete version and remediation information warrants direct verification against current O-RAN guidance rather than assuming systems are safe or patched.
Technical view
The reported crash occurs in sctpThread.cpp when the Prometheus Increment function accesses the RIC subscription success counter through message.peerInfo and related SCTP structures. CVSS 3.1 rates it network-accessible, low complexity, unauthenticated, and requiring no user interaction, with availability impact only. It is classified as CWE-770.
Likely exposure
Potential exposure exists where O-RAN E2T I-Release deployments contain the affected counter-update path and accept network traffic from untrusted or broadly accessible sources. Exact products, versions, and CPEs are not supplied, so asset-level exposure cannot be confirmed from these sources alone.
Exploitation context
The CVSS vector indicates remote, unauthenticated reachability and low attack complexity. However, the CVE is not listed as KEV in the supplied bundle, and no cited source confirms active exploitation or public exploit availability. Treat exploitation status as unconfirmed.
Researcher notes
Evidence supports an availability crash involving a Prometheus counter increment, but the supplied record omits affected versions, CPEs, root-cause detail, patch commits, and fixed releases. CWE-770 is assigned, although the description alone does not fully explain the resource-management mechanism. No confidentiality or integrity impact is scored.
Mitigation direction
- Identify deployments containing the O-RAN E2T I-Release and the referenced sctpThread.cpp code path.
- Check the O-RAN Jira issue and CVE record for current patch or upgrade guidance.
- Restrict affected service access to trusted network peers where operationally feasible.
- Monitor and automatically recover affected processes while permanent remediation is evaluated.
Validation and detection
- Inventory deployed E2T builds and record their exact source revision or package version.
- Compare deployed code and release metadata against the O-RAN Jira issue.
- Review logs and crash reports for sctpThread.cpp or RIC subscription counter failures.
- Confirm network controls prevent unnecessary untrusted access to affected services.
- After remediation, validate subscription handling and Prometheus metrics in a controlled environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-34046 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE publishedCVE Program
The CVE record was published.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://jira.o-ran-sc.org/browse/RIC-1047CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.