Medium severity · published Nov 1, 2024
CVE-2024-51406
Floodlight SDN Open Flow Controller v.1.2 has an issue that allows local hosts to build fake LLDP packets that allow specific clusters to be missed by Floodlight, which in turn…
6.2
CVSS
0.2%
EPSS
No
On KEV
Description
Floodlight SDN Open Flow Controller v.1.2 has an issue that allows local hosts to build fake LLDP packets that allow specific clusters to be missed by Floodlight, which in turn leads to missed hosts inside and outside the cluster.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Open Sdn Controller · Projectfloodlight
1.2 · source: NVD
FL
Floodlight · Projectfloodlight
1.2 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-51406
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-51406
Product
https://github.com/floodlight/floodlight
Exploit
https://github.com/floodlight/floodlight/issues/870
Technical Description
https://ieeexplore.ieee.org/document/10246976
More from Open Sdn Controller
7.5
CVE-2014-2304
A vulnerability in version 0.90 of the Open Floodlight SDN controller software could result in a denial of service attack and crashing of the controller service
7.5
CVE-2013-7333
A vulnerability in version 0.90 of the Open Floodlight SDN controller software could allow an attacker with access to the OpenFlow control network to selectively disconnect…
6.3
CVE-2024-29461
An issue in Floodlight SDN OpenFlow Controller v.1.2 allows a remote attacker to cause a denial of service via the datapath id component