Priority HIGH 78
An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link type from indirect to direct.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00492 · Published 2025-03-24 · No fix listed CWE-670
Priority MEDIUM 51
An issue was discovered in ONOS 2.5.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00987 · Published 2023-04-20 · No fix listed CWE-20
Priority MEDIUM 51
An issue was discovered in ONOS 2.5.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01007 · Published 2023-04-20 · No fix listed CWE-178
Priority MEDIUM 50
An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00567 · Published 2025-03-24 · No fix listed CWE-502
Priority MEDIUM 49
An issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses and potentially execute a man-in-the-middle attack on communications between fake and real hosts.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00413 · Published 2025-05-29 · No fix listed CWE-290
Priority MEDIUM 40
An issue was discovered in ONOS 2.5.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00874 · Published 2023-04-20 · No fix listed
Priority MEDIUM 40
An issue was discovered in ONOS 2.5.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00668 · Published 2023-04-20 · No fix listed CWE-670
Priority MEDIUM 40
An issue was discovered in ONOS 2.5.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00654 · Published 2023-04-20 · No fix listed CWE-670
Priority MEDIUM 40
An issue was discovered in ONOS 2.5.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00856 · Published 2023-04-20 · No fix listed CWE-400
Priority MEDIUM 40
An issue was discovered in ONOS 2.5.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00654 · Published 2023-04-20 · No fix listed CWE-755
Priority LOW 39
Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00374 · Published 2025-03-24 · No fix listed CWE-331
Priority LOW 36
An issue was discovered in ONOS 2.5.1.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00848 · Published 2023-04-20 · No fix listed CWE-400
Priority LOW 36
An issue was discovered in ONOS 2.5.1.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00848 · Published 2023-04-20 · No fix listed CWE-697
Priority LOW 35
Authentication Bypass by Spoofing in org.onosproject.acl (access control) and org.onosproject.mobility (host mobility) in ONOS v2.0 and earlier allows attackers to bypass network access control via data plane packet inje…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01053 · Published 2020-02-20 · No fix listed CWE-290
Priority LOW 31
An issue was discovered in ONOS 2.5.1.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00758 · Published 2023-04-20 · No fix listed CWE-697
Priority LOW 31
An issue was discovered in ONOS 2.5.1.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00567 · Published 2023-04-20 · No fix listed CWE-670
Priority LOW 28
A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00628 · Published 2023-03-14 · No fix listed CWE-79
Priority LOW 27
Open Networking Foundation (ONF) ONOS version 1.13.2 and earlier version contains a Directory Traversal vulnerability in core/common/src/main/java/org/onosproject/common/app/ApplicationArchive.java line 35 that can resul…
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01282 · Published 2018-07-23 · No fix listed CWE-22
Priority LOW 25
An issue in Open Network Foundation ONOS v2.7.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted packets.
CVSS 3.1MEDIUM 5.6· Network · No auth · No interaction · EPSS 0.00287 · Published 2025-05-29 · No fix listed CWE-400
THREATIST.IORead the docs