Executive brief
Floodlight is an open-source network controller that manages OpenFlow switches and ensures proper routing of traffic between hosts. Under a malicious link spoofing attack, the controller misclassifies ports connecting to hosts as internal network links, causing it to refuse forwarding packets and setting up routing rules. This disrupts communication for legitimate hosts trying to exchange traffic through the affected switches.
Technical details
The vulnerability is a topology boundary identification flaw in the Floodlight controller's handling of packet-in messages containing high-layer protocol packets. The root cause is improper classification of switch ports during link spoofing attacks: ports that should be marked as boundaries (connecting to end hosts) are incorrectly classified as non-boundaries (internal network links). This occurs because the controller does not adequately validate link authenticity before updating its topology model. An attacker with the ability to inject spoofed link advertisements can trigger this misclassification, preventing packet forwarding and flow rule installation to legitimate hosts. The attack requires network access to the OpenFlow topology but does not require authentication to the controller itself. A patch or fix has not been confirmed at the time of publication.
Affected products
- Floodlight Floodlight 71fe8a7
Timeline
- 2025-03-27: disclosed: Issue #873 opened on GitHub
- 2026-09-13: advisory: CVE-2025-45480 published on NVD