CVE-2017-1000081
CriticalSummary
ONOS version 1.9.0 is vulnerable to unauthenticated upload of applications (.oar), leading to remote code execution.
Risk Assessment
Exploitation of this vulnerability could allow attackers to remotely execute arbitrary code on the server, posing a significant security risk.
Recommendation
It is recommended to upgrade ONOS to the latest version to mitigate this vulnerability and implement authorization mechanisms for application uploads.
Other vulnerabilities in ONOS 1.9.0
See all- CVE-2017-13763High
ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited.
- CVE-2017-1000080High
ONOS version 1.9.0 allows unauthenticated use of websockets, which may lead to unauthorized access to the system.
- CVE-2017-1000079High
ONOS version 1.9.0, developed by the Linux Foundation, is vulnerable to a DoS attack.
Original NVD description (English source)
Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code execution.