Medium severity · published Apr 12, 2024
CVE-2024-29461
An issue in Floodlight SDN OpenFlow Controller v.1.2 allows a remote attacker to cause a denial of service via the datapath id component
6.3
CVSS
0.5%
EPSS
No
On KEV
Description
An issue in Floodlight SDN OpenFlow Controller v.1.2 allows a remote attacker to cause a denial of service via the datapath id component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Open Sdn Controller · Projectfloodlight
1.2 · source: NVD
FC
Floodlight Controller · Atlassian
v.1.2 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-29461
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-29461
Exploit
https://gist.github.com/ErodedElk/399a226905c574efe705e3bff77955e3
Exploit
https://github.com/floodlight/floodlight/issues/867
More from Open Sdn Controller
7.5
CVE-2014-2304
A vulnerability in version 0.90 of the Open Floodlight SDN controller software could result in a denial of service attack and crashing of the controller service
7.5
CVE-2013-7333
A vulnerability in version 0.90 of the Open Floodlight SDN controller software could allow an attacker with access to the OpenFlow control network to selectively disconnect…
6.2
CVE-2024-51406
Floodlight SDN Open Flow Controller v.1.2 has an issue that allows local hosts to build fake LLDP packets that allow specific clusters to be missed by Floodlight, which in turn…