CVE-2024-37018

The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets.

Score

CVSS 3.1 9.1 Critical

Status

Deferred - cve@mitre.org

Published

2024-05-31

Last modified

2025-02-13

Weaknesses

CWE-648

Affected products

• Opendaylight (Linuxfoundation)

References

• https://dl.acm.org/doi/10.1145/3658644.3690345
• https://github.com/mzc796/marionette_odl
• https://github.com/mzc796/marionette_onos
• https://jira.opendaylight.org/browse/DISCOVERY-2
• https://mvnrepository.com/artifact/org.opendaylight.controller