CVE-2021-38364

MEDIUM

ONOS 2.5.1 - Incorrect Flow Rule Comparison via Intent Manipulation

Title source: llm
STIX 2.1

Description

An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents.

References (2)

Core 2
Core References
Exploit, Technical Description, Third Party Advisory
https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf

Scores

CVSS v3 6.5
EPSS 0.0085
EPSS Percentile 53.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-697
Status published
Products (1)
opennetworking/onos 2.5.1
Published Apr 20, 2023
Tracked Since Feb 18, 2026