PT-2024-34620 · Unknown · Open Floodlight Sdn Controller

Saber-Berserker · Published 2024-11-01 · Updated 2025-06-11 · CVE-2024-51406

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Floodlight SDN Open Flow Controller version 1.2

Description The issue allows local hosts to build fake LLDP packets, which can cause specific clusters to be missed by Floodlight. This, in turn, leads to missed hosts inside and outside the cluster. An attacker can gain elevated privileges through local privilege escalation.

Recommendations For Floodlight SDN Open Flow Controller version 1.2, patch immediately to prevent local privilege escalation. Monitor for potential exploits and assess the impact on the SDN stack. As a temporary workaround, consider restricting access to the LLDP packet handler to minimize the risk of exploitation.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2024-51406

Affected Products

Open Floodlight Sdn Controller

References · 9

• 🔥 https://github.com/floodlight/floodlight/issues/870 · Exploit
• https://osv.dev/vulnerability/CVE-2024-51406 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51406 · Security Note
• https://github.com/floodlight/floodlight · Note
• https://t.me/cvenotify/125376 · Telegram Post
• https://twitter.com/CVEnew/status/1852345307612185053 · Twitter Post
• https://t.me/cvedetector/9578 · Telegram Post
• https://ieeexplore.ieee.org/document/10246976 · Note
• https://twitter.com/oktsec/status/1852374511695417404 · Twitter Post