Cyber Posture

CVE-2025-29310

Critical

Published: 24 March 2025

Published
24 March 2025
Modified
01 April 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0019 40.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

Security Summary

CVE-2025-29310 is a critical deserialization vulnerability (CWE-502) affecting ONOS version 2.7.0, published on 2025-03-24. The flaw arises from inadequate handling of crafted Link Layer Discovery Protocol (LLDP) packets, enabling a packet deserialization issue that compromises the software's integrity.

Remote attackers require no privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) and can exploit it by supplying a malicious LLDP packet over the network. Successful exploitation allows arbitrary command execution or unauthorized access to network information.

For mitigation details, refer to the advisory at https://gist.github.com/Saber-Berserker/10c9d548b38fa988310d90b8314e3129.

Details

CWE(s)
CWE-502

Affected Products

opennetworking
onos
2.7.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
Why these techniques?

The deserialization flaw in ONOS enables remote exploitation of a network-accessible application (T1190) via malicious LLDP packets, directly resulting in arbitrary command execution (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References