TI-2022-08054 Aliases CVE-2022-24109 GHSA-3hc4-p5q8-6mx3

An issue was discovered in ONOS 2.5.1.

LOW 36CWE-400Published 2023-04-20 · Updated 2025-02-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · Low · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-400.

Summary

An issue was discovered in ONOS 2.5.1. To attack an intent installed by a normal user, a remote attacker can install a duplicate intent with a different key, and then remove the duplicate one. This will remove the flow rules of the intent, even though the intent still exists in the controller.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00848 58th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:opennetworking:onos:2.5.1:::::::*	2.5.1	Vulnerable	Open Networking Foundation (ONF)

cpe:2.3:a:opennetworking:onos:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·Open Networking Foundation (ONF)

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-24109
2026-10-03 Alias added: GHSA-3hc4-p5q8-6mx3

References

Exploit 1

https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf

Other 1

https://wiki.onosproject.org/display/ONOS/Intent+Framework

TI-2025-21037 An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device… CVSS 3.1CRITICAL 9.1
TI-2022-12041 An issue was discovered in ONOS 2.5.1. CVSS 3.1CRITICAL 9.8
TI-2022-12039 An issue was discovered in ONOS 2.5.1. CVSS 3.1CRITICAL 9.8
TI-2025-21035 An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when… CVSS 3.1CRITICAL 9.8
TI-2023-22038 An issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC… CVSS 3.1CRITICAL 9.8
TI-2022-12043 An issue was discovered in ONOS 2.5.1. CVSS 3.1HIGH 7.5

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences