PT-2025-12712 · Opendaylight+1 · Opendaylight Service Function Chaining (Sfc) Subproject+1

Published 2025-03-24 · Updated 2025-03-25 · CVE-2025-29315

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenDaylight Service Function Chaining (SFC) Subproject SFC versions Sodium-SR4 and below

Description An issue in the Shiro-based RBAC (Role-based Access Control) mechanism allows attackers to execute privileged operations via a crafted request.

Recommendations For OpenDaylight Service Function Chaining (SFC) Subproject SFC versions Sodium-SR4 and below, consider disabling the Shiro-based RBAC mechanism until a patch is available. As a temporary workaround, restrict access to the SFC Subproject to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-29315

GHSA-X65V-G96X-C6GW

Affected Products

Opendaylight Service Function Chaining (Sfc) Subproject

Shiro

References · 8

• 🔥 https://blog.csdn.net/weixin_43959580/article/details/144794289 · Exploit
• https://osv.dev/vulnerability/GHSA-x65v-g96x-c6gw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29315 · Security Note
• https://github.com/opendaylight/sfc · Note
• https://twitter.com/CVEnew/status/1904280530449060154 · Twitter Post
• https://t.me/cvetracker/19801 · Telegram Post
• https://twitter.com/CVETracker/status/1904624512823366111 · Twitter Post
• https://t.me/cvedetector/21008 · Telegram Post