CVE-2017-1000080
HighSummary
ONOS version 1.9.0 allows unauthenticated use of websockets, which may lead to unauthorized access to the system.
Risk Assessment
The organization may be exposed to attacks exploiting vulnerabilities in websocket security, potentially leading to data disclosure or system takeover.
Recommendation
It is recommended to update ONOS to the latest version that fixes this vulnerability and implement appropriate authorization mechanisms for websockets.
Other vulnerabilities in ONOS 1.9.0
See all- CVE-2017-13763High
ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited.
- CVE-2017-1000079High
ONOS version 1.9.0, developed by the Linux Foundation, is vulnerable to a DoS attack.
- CVE-2017-1000081Critical
ONOS version 1.9.0 is vulnerable to unauthenticated upload of applications (.oar), leading to remote code execution.
Original NVD description (English source)
Linux foundation ONOS 1.9.0 allows unauthenticated use of websockets.