CVE-2019-11189

The CVE describes an Authentication Bypass in ONOS v2.0 and earlier via data plane packet injection. A gratuitous ARP reply can trigger the host mobility application to remove existing access control flow denial rules, and the access control app does not re-install those deny rules, allowing bypa...

CVE-2025-29311

CVE-2025-29311 affects ONOS v2.7.0, where a limited secret space in LLDP packets can let an attacker brute-force obtain the private key and craft LLDP packets. The public documents confirm the vulnerability and potential for exploit via crafted LLDP frames, but do not provide a concrete patch ver...

CVE-2023-24279

ONOS (Open Networking Foundation) is affected by a cross-site scripting (XSS) vulnerability in versions v1.9.0 through v2.7.0, exploitable via a crafted payload injected into the URL parameter of the API documentation dashboard. The concise root cause in the connected documents points to reflecti...

CVE-2023-41591

CVE-2023-41591 affects Open Network Foundation ONOS v2.7.0. The issue allows an attacker to create fake IP/MAC addresses, enabling potential man-in-the-middle attacks between spoofed and legitimate hosts. The Red Hat and NVD/NVDA references describe the same impact. Snyk reports org.onosproject:o...

CVE-2025-29310

The CVE refers to ONOS v2.7.0 where a vulnerability in LLDP packet deserialization can be triggered by a crafted LLDP packet, allowing an attacker to execute arbitrary commands or access network information. Affected component: ONOS 2.7.0 (deserialization path in LLDP handling). Root cause: packe...

CVE-2025-29312

CVE-2025-29312 affects ONOS v2.7.0. The vulnerability allows triggering unexpected behavior in a device connected to a legacy switch by changing the link type from indirect to direct. CVSS 3.1 base score 9.1 (CRITICAL) with Network attack vector, no privileges required, no user interaction; confi...

CVE-2021-38363

Summary: CVE-2021-38363 affects ONOS 2.5.1. In the IntentManager, an install-requested intent that triggers an exception remains in the in‑memory pendingMap forever and cannot be deleted by a user or by the intermittent Intent Cleanup process. Impact (per sources): Fails to remove aborted/errored...

CVE-2024-53423

CVE-2024-53423 concerns Open Network Foundation ONOS v2.7.0 where attackers can cause a Denial of Service by sending crafted packets. The entry is supported by multiple sources (NVD, CVE records, Red Hat advisory, OSV, CNNVD, PT Security). CVSS v3.1 base score is 5.6 (Network, Low/Low/Low impacts...

CVE-2022-24109

The CVE-2022-24109 entry concerns the Open Networking Foundation ONOS 2.5.1. An attacker can install a duplicate intent (with a different key) for an intent installed by a normal user, then remove the duplicate; this action removes the flow rules of the original intent even though the intent rema...

CVE-2021-38364

CVE-2021-38364 affects ONOS 2.5.1, where an incorrect comparison of flow rules installed by intents can let a remote attacker install or remove an intent and consequently modify or delete flow rules related to other intents. The consequence is unintended modification of flow state managed by the ...

CVE-2022-29607

CVE-2022-29607 affects ONOS 2.5.1. The issue arises when modifying an existing intent to have the same source and destination, which causes the system to show the INSTALLED state even though no flow rule is installed. The description indicates this can mislead a network operator. No specific expl...

CVE-2022-29608

CVE-2022-29608 affects ONOS 2.5.1. The issue arises when an intent uses a port that is an intermediate point in its path, which results in the installation of an invalid flow rule and can create a network loop. The available connected documents confirm the affected software and the underlying beh...

CVE-2022-29606

ONOS 2.5.1 contains a vulnerability where an intent with large port numbers can enter a CORRUPT state, creating inconsistency between the declared intent and the resulting flow rules. Affected component is the intent handling/validation logic within the ONOS controller’s intent framework. The iss...

CVE-2022-29609

CVE-2022-29609 affects ONOS 2.5.1. The issue is that an intent with the same source and destination can appear in the INSTALLING state, suggesting its flow rules are installing. This incorrect handling is described as misleading to a network operator. The connected documents confirm the affected ...

CVE-2022-24035

ONOS 2.5.1 is affected: the purge-requested intent remains in the list and does not respond to topology changes (e.g., link failures), potentially causing network management failures. A temporary workaround from multiple sources is to disable the purge-requested intent functionality until a patch...

CVE-2018-1999020

The CVE-2018-1999020 issue affects Open Networking Foundation ONOS (ONOS) versions 1.13.2 and earlier. It is a Directory Traversal vulnerability in core/common/src/main/java/org/onosproject/common/app/ApplicationArchive.java (line 35) that can result in arbitrary file deletion (overwrite) when a ...

CVE-2022-29944

CVE-2022-29944 affects ONOS 2.5.1. The issue is an incorrect comparison of paths installed by intents, causing an existing intent to not redirect to a new path when a higher-priority intent shares that path. The public documents consistently describe this as the root cause but do not provide conc...

CVE-2022-29605

CVE-2022-29605 affects ONOS 2.5.1. The issue arises in the IntentManager , which attempts to install IPv6 flow rules for an intent into an OpenFlow 1.0 switch that does not support IPv6, due to improper handling of the capabilities mismatch. This discrepancy can mislead network operators about th...

CVE-2022-29604

ONOS 2.5.1 is affected: an intent with an uppercase device ID can enter a CORRUPT state due to case-sensitivity mishandling, causing inconsistency between intent and flow rules. The connected documents reiterate the issue but do not provide a concrete fix or remediation details. No further exploi...