CVE-2015-1612 json
OpenFlow plugin for OpenDaylight LLDP Relay
published 9y ago modified 4mo ago also GHSA-f2x4-547g-rp95 , EUVD-2015-1743
- cvss
- 7.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 81%
- public exploits
- 0
- none known
Summary
OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to the reuse of LLDP packets, aka "LLDP Relay."
Patch / fix
- maven org.opendaylight.openflowplugin:openflowplugin 0.0.6-Helium-SR3
Is CVE-2015-1612 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
2.07% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.opendaylight.openflowplugin:openflowplugin | <0.0.6-Helium-SR3 |
0.0.6-Helium-SR3 |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
git.opendaylight.org
/gerrit/#/c/16208/
issue-tracking, patch, third-party-advisory
-
wiki.opendaylight.org
/view/Security_Advisories#.5BModerate.5D_CVE-2015-1611_CVE-2015-1612_openflowplugin:_topology_spoofing_via_LLD
patch, third-party-advisory
-
git.opendaylight.org
/gerrit/#/c/16193/
issue-tracking, patch, third-party-advisory
-
internetsociety.org
/sites/default/files/10_4_2.pdf
technical-description
-
securityfocus.com
/bid/73254
vdb-entry, third-party-advisory
-
cloudrouter.org
/security/
third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2015-1612
advisory
-
git.opendaylight.org
/gerrit/#/c/16193
web
-
git.opendaylight.org
/gerrit/#/c/16208
web
-
github.com
/opendaylight/openflowplugin
package
-
web.archive.org
/web/20150510044305/https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1611_CVE-20
web
-
web.archive.org
/web/20150701104709/https://www.internetsociety.org/sites/default/files/10_4_2.pdf
web
Sources
- CVE List CVE-2015-1612
- GitHub Advisory GHSA-f2x4-547g-rp95
- NVD CVE-2015-1612
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.