CVE-2024-37018

The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets

Critical · published May 31, 2024

CVSS v3.1
9.1
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

🔥 A crafty API manipulation lets attackers poison your network's topology with OpenDaylight 0.15.3 — a bit like a con artist rerouting your mail to their own address! Think of it like a delivery service that lets anyone change the destination of your packages without verifying their identity — the packages end up at the wrong location, and you never receive them. This is how attackers can disrupt your network's functionality by misleading discovery packets. If exploited, an attacker could reroute critical data packets across your network, potentially allowing them to intercept sensitive information or disrupt services altogether. This could lead to absolutely devastating consequences for your operations, leaving your systems vulnerable and your users in jeopardy!

Put simply

Think of it like a delivery service that lets anyone change the destination of your packages without verifying their identity — the packages end up at the wrong location, and you never receive them. This is how attackers can disrupt your network's functionality by misleading discovery packets. This vulnerability allows an application to manipulate the path discovery packets take, leading to topology poisoning. As a result, the system's understanding of the network structure can be significantly altered by a malicious actor.

What to do

If exploited, an attacker could reroute critical data packets across your network, potentially allowing them to intercept sensitive information or disrupt services altogether. This could lead to absolutely devastating consequences for your operations, leaving your systems vulnerable and your users in jeopardy! To address this, patch your OpenDaylight installation to version 0.15.4 immediately. Additionally, review your API access controls and ensure strict validation of requests to prevent unauthorized manipulations. Regular audits of your network topology can also help catch any anomalies early. You've got this! By following these steps, you can secure your network and boost your security hero status! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00433 · 36.5th percentile
Published
2024-05-31T00:35Z
EPSS history
Timeline
  • 31 MAY 00:35Z
    The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets
    cvelistv5