OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the…
Priority LOW 37CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injection."
Why it matters now
EPSS 0.02073 81st percentileScored 2026-11-07
Fix Fixed org.opendaylight.openflowplugin:openflowplugin (Maven): 0.0.6-Helium-SR3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.opendaylight.openflowplugin:openflowplugin (Maven) | before 0.0.6-Helium-SR3 | 0.0.6-Helium-SR3 | Patch available | GHSA-49wf-927p-jpvj |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.opendaylight.openflowplugin:openflowplugin (Maven) Vendor— Affected before 0.0.6-Helium-SR3 Fixed in 0.0.6-Helium-SR3 Patch available GHSA-49wf-927p-jpvj
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opendaylight:openflow:-:*:*:*:*:opendaylight:*:* | not specified by NVD | Vulnerable | OpenDayLight |
- cpe:2.3:a:opendaylight:openflow:-:*:*:*:*:opendaylight:*:* Versions not specified by NVD Vulnerable ·OpenDayLight
Remediation
- Fix · GHSA-49wf-927p-jpvj org.opendaylight.openflowplugin:openflowplugin (Maven) Fixed in 0.0.6-Helium-SR3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2015-1611
- 2026-10-03 Alias added: GHSA-49wf-927p-jpvj
References
Patch 3
Other 6
- http://www.internetsociety.org/sites/default/files/10_4_2.pdf
- https://git.opendaylight.org/gerrit/#/c/16193
- https://git.opendaylight.org/gerrit/#/c/16208
- https://github.com/opendaylight/openflowplugin
- https://web.archive.org/web/20150510044305/https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1611_CVE-2015-1612_openflowplugin:_topology_spoofing_via_LLDP
- https://web.archive.org/web/20150701104709/https://www.internetsociety.org/sites/default/files/10_4_2.pdf
More OpenDayLight Openflow vulnerabilities
- TI-2018-00997 Improper input validation in OpenDayLight CVSS 3.0CRITICAL 9.8
- TI-2015-01444 OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the… CVSS 3.0HIGH 7.5
- TI-2017-14630 OpenFlow Plugin and OpenDayLight Controller versions Nitrogen, Carbon, Boron, Robert… CVSS 3.0HIGH 7.5
Sources
- CVE-2015-1611 · CVE Program
- CVE-2015-1611 · NVD
- FIRST EPSS
- GHSA-49wf-927p-jpvj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences