CVE-2024-37018

9.1 criticalEPSS 0.4%

Critical (9.1). EPSS 0.4% chance of exploitation in the next 30 days.

The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken by discovery packets.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-648
Published: 2024-05-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://dl.acm.org/doi/10.1145/3658644.3690345
https://github.com/mzc796/marionette_odl
https://github.com/mzc796/marionette_onos
https://jira.opendaylight.org/browse/DISCOVERY-2
https://mvnrepository.com/artifact/org.opendaylight.controller

Check your stack JSON