PT-2025-12708 · Onos · Onos

Published 2025-03-24 · Updated 2025-04-01 · CVE-2025-29311

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions onos version 2.7.0

Description The issue is related to limited secret space in LLDP packets, which can be exploited by attackers to obtain the private key via a brute force attack. Attackers can leverage this to create crafted LLDP packets.

Recommendations For onos version 2.7.0, consider restricting access to LLDP packets until a patch is available. As a temporary workaround, limit the use of LLDP packets to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-331

Related Identifiers

CVE-2025-29311

Affected Products

Onos

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-29311 · Security Note
• https://osv.dev/vulnerability/CVE-2025-29311 · Vendor Advisory
• https://twitter.com/CVETracker/status/1904624514345935294 · Twitter Post
• https://t.me/cvetracker/19797 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1904384370557030443 · Twitter Post
• https://gist.github.com/Saber-Berserker/790f2a75ae482df3fd0fce569f30504a; · Note
• https://t.me/cvenotify/117273 · Telegram Post
• https://twitter.com/CVEnew/status/1904275036619640959 · Twitter Post
• https://t.me/cvedetector/21004 · Telegram Post