Floodlight
Monthly
Link spoofing in Floodlight SDN controller (commit 71fe8a7) enables adjacent-network attackers to inject false topology information, causing the controller to misclassify a boundary port as a non-boundary port and disrupting legitimate host communication. The vulnerability targets OpenFlow-based topology discovery, requires adjacent network positioning and low privileges (AV:A/PR:L), and carries a low CVSS base score of 3.0 with a scope change (S:C) reflecting cross-component impact on the controller's global network view. No public exploit code and no active exploitation have been identified at time of analysis.
An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module and Linkdiscovery module. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module, Topologylnstance module, Routing module. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Floodlight SDN OpenFlow Controller v.1.2 has an issue that allows local hosts to construct false broadcast ports causing inter-host communication anomalies. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Floodlight version 1.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in the web console that can result in javascript injections into the web page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Link spoofing in Floodlight SDN controller (commit 71fe8a7) enables adjacent-network attackers to inject false topology information, causing the controller to misclassify a boundary port as a non-boundary port and disrupting legitimate host communication. The vulnerability targets OpenFlow-based topology discovery, requires adjacent network positioning and low privileges (AV:A/PR:L), and carries a low CVSS base score of 3.0 with a scope change (S:C) reflecting cross-component impact on the controller's global network view. No public exploit code and no active exploitation have been identified at time of analysis.
An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module and Linkdiscovery module. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue in floodlight v1.2 allows a local attacker to cause a denial of service via the Topology Manager module, Topologylnstance module, Routing module. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Floodlight SDN OpenFlow Controller v.1.2 has an issue that allows local hosts to construct false broadcast ports causing inter-host communication anomalies. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Floodlight version 1.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in the web console that can result in javascript injections into the web page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.