CVE-2025-29312

An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link type from indirect…

Critical · published March 24, 2025

CVSS v3.1
9.1
EPSS
0%
Percentile
41.3
In the wild
Unconfirmed
What it is

🔥 An attacker can flip the link type from indirect to direct on devices connected to legacy switches in ONOS v2.7.0, unleashing unexpected chaos! Think of it like a train conductor suddenly changing the tracks without warning—your train (or device) could end up in a completely different place! This unexpected switch could lead to catastrophic network disruptions, allowing attackers to manipulate device behavior, potentially hijacking traffic or causing data loss. The fallout from this could be absolutely devastating for your network integrity!

Put simply

Think of it like a train conductor suddenly changing the tracks without warning—your train (or device) could end up in a completely different place! In ONOS v2.7.0, a flaw allows unauthorized changes to the link type of devices connected via legacy switches, triggering unintended behavior that can compromise network operations.

What to do

This unexpected switch could lead to catastrophic network disruptions, allowing attackers to manipulate device behavior, potentially hijacking traffic or causing data loss. The fallout from this could be absolutely devastating for your network integrity! Immediate action is crucial: Update to a patched version of ONOS or implement strict access controls to prevent unauthorized modifications. Review your network configurations to ensure that legacy switches are appropriately secured. You've got this! Stay vigilant and tackle this vulnerability to keep your network safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00492 · 41.3th percentile
Published
2025-03-24T00:00Z
EPSS history
Timeline
  • 24 MAR 00:00Z
    An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link type from indirect…
    cvelistv5