CVE-2025-54992CWE-611

OpenKilda XXE in SAML configuration

Medium · published August 11, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
35.5
In the wild
Unconfirmed
What it is

OpenKilda is an open-source OpenFlow controller. Prior to version 1.164.0, an XML external entity (XXE) injection vulnerability was found in OpenKilda which in combination with GHSL-2025-024 allows unauthenticated attackers to exfiltrate information from the instance where the OpenKilda UI is running. This issue may lead to Information disclosure. This issue has been patched in version 1.164.0.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00423 · 35.5th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2025-08-11T21:34Z
EPSS history
Timeline
  • 11 AUG 21:34Z
    OpenKilda XXE in SAML configuration
    cvelistv5