PatchTheCVEonos vulnerabilities and fixes
Recent CVEs affecting onos, with upgrade or downgrade steps. 5 tracked.
onos has 5 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-05-29. Highest priority: CVE-2025-29312 (score 52/100).
- CVE-2025-29312 CRITICAL 9.1 DOWNGRADE An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy
- CVE-2025-29311 HIGH 7.5 DOWNGRADE Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a brut
- CVE-2025-29310 CRITICAL 9.8 DOWNGRADE An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted
- CVE-2024-53423 MEDIUM 5.6 DOWNGRADE An issue in Open Network Foundation ONOS v2.7.0 allows attackers to cause a Denial of Service (DoS) via supply
- CVE-2023-41591 CRITICAL 9.8 DOWNGRADE An issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses and potential
FAQ
How do I fix onos vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is onos being exploited right now?
None of the tracked onos CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which onos CVE should I patch first?
CVE-2025-29312 currently ranks highest (52/100): An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy .