CVE-2023-41591

The vulnerability is based on an authentication bypass mechanism through spoofing (CWE-290) — the ONOS system does not sufficiently verify the authenticity of IP and MAC addresses reported by hosts. An attacker can register false IP/MAC address pairs in the SDN controller without any authentication. This allows the attacker to inject crafted network topology information into the ONOS system, which enables interception of network traffic between victims.

An attacker can take control over network traffic flow and conduct a man-in-the-middle attack, enabling interception, modification, or injection of communication between hosts in the managed SDN network. As a result, it is possible to compromise the confidentiality, integrity, and availability of data transmitted over the network.

Apply patches available from the vendor according to the references. It is also recommended to implement additional mechanisms for verifying host identity in the SDN network and restrict access to the ONOS controller API only to trusted network segments.

Open Network Foundation ONOS version 2.7.0