EUVD-2025-210893
GHSA-j3hr-9jf2-7jhv
Severity by source
AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
AV:A and AC:H reflect adjacent-only link spoofing with crafting complexity; A:L added because description explicitly states host communication disruption.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.
AnalysisAI
Link spoofing in Floodlight SDN controller (commit 71fe8a7) enables adjacent-network attackers to inject false topology information, causing the controller to misclassify a boundary port as a non-boundary port and disrupting legitimate host communication. The vulnerability targets OpenFlow-based topology discovery, requires adjacent network positioning and low privileges (AV:A/PR:L), and carries a low CVSS base score of 3.0 with a scope change (S:C) reflecting cross-component impact on the controller's global network view. No public exploit code and no active exploitation have been identified at time of analysis.
Technical ContextAI
Floodlight (CPE: cpe:2.3:a:projectfloodlight:floodlight:*:*:*:*:*:*:*:*) is an open-source Java-based OpenFlow SDN controller. In OpenFlow SDN architectures, the controller builds and maintains a global view of network topology using LLDP (Link Layer Discovery Protocol) discovery packets. A boundary port is one connecting to an external or inter-domain segment and must be treated differently from internal ports for correct forwarding decisions. CWE-669 (Incorrect Resource Transfer Between Spheres) captures the root cause: the controller incorrectly promotes a port from the boundary trust domain into the internal/non-boundary domain. An attacker able to inject crafted link-layer frames on an adjacent segment can manipulate LLDP topology data, causing the controller to update its topology map erroneously and apply incorrect forwarding and access rules to hosts on the managed network.
RemediationAI
No vendor-released patch has been identified at time of analysis; the issue remains open in the Floodlight GitHub tracker at https://github.com/floodlight/floodlight/issues/873. As a compensating control, administrators should configure edge switches to filter and drop unsolicited LLDP frames from untrusted or end-host ports, preventing injected topology frames from reaching the controller's topology-discovery pipeline - the trade-off is that legitimate LLDP-based discovery must be carefully scoped so as not to break valid inter-switch link detection. Enabling 802.1X port authentication on SDN-managed segments restricts the ability of unauthorized adjacent-network attackers to inject link-layer frames at the cost of added provisioning complexity. Additionally, monitoring the Floodlight controller's topology view for unexpected reclassification of known boundary ports can serve as a detection compensating control without requiring network changes.
More in Floodlight
View allFloodlight SDN OpenFlow Controller v.1.2 has an issue that allows local hosts to construct false broadcast ports causing
Floodlight version 1.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in the web console that can resul
An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module, Topolo
An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module and Lin
Share
External POC / Exploit Code
Leaving vuln.today