Description

Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.0",
  "pubDate": "2026-09-13T19:16:52.553Z",
  "pubdate": "2026-09-13T19:16:52.553Z",
  "executiveSummary": "Floodlight version 71fe8a7 is susceptible to a link spoofing vulnerability caused by an incorrect port classification logic. This flaw allows a remote attacker to manipulate the network topology discovery process by misclassifying boundary ports as internal non-boundary ports.\nThe vulnerability primarily impacts the controller's ability to maintain a consistent and accurate network topology map. By injecting unauthorized Link Layer Discovery Protocol (LLDP) packets or similar control-plane messages, an attacker can effectively disrupt host-to-host communication and potentially reroute traffic.\nThe risk implication is significant as it undermines the foundation of software-defined networking (SDN) operations within the Floodlight controller. An attacker does not require elevated privileges on the controller itself but must be able to influence traffic originating from a network device or a compromised host connected to the switch fabric.\nExploitation results in a denial-of-service state for specific network segments, where valid communication paths are discarded due to the manipulated topology information. Organizations relying on Floodlight for flow management must ensure that port security and boundary definitions are strictly enforced to prevent unauthorized topology modification.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper classification of network ports within the Floodlight 71fe8a7 controller's topology management module. Specifically, the system fails to correctly distinguish between boundary ports (ports connected to edge hosts) and inter-switch links (non-boundary ports) during the discovery and update process.\nIn a standard SDN environment, the controller utilizes LLDP or similar protocols to discover the network topology. Boundary ports should be designated as edge ports, where the controller expects to see end-hosts. Non-boundary ports represent internal links between OpenFlow-enabled switches. The vulnerability occurs when an attacker sends forged link advertisement packets that trigger the controller to misidentify an edge port as an internal switch port.\nThe attack flow follows a structured exploitation path: First, the attacker identifies a switch port connected to the network that is monitored by the Floodlight controller. Second, the attacker generates a malicious packet mimicking the link advertisement frames that the controller typically uses to form the internal topology map. Third, the attacker transmits these packets to the switch, which subsequently forwards them to the controller.\nUpon receiving these forged packets, the Floodlight controller processes the data and updates its internal topology database. Due to the flawed classification logic, the controller incorrectly classifies the attacker-controlled port as a non-boundary port. This state change informs the controller that the port is part of the internal fabric rather than an edge connection.\nThe post-exploitation impact is a disruption of host communication. Because the controller believes the attacker-controlled port is an internal switch-to-switch link, it may inadvertently attempt to route inter-switch traffic through the attacker's port or, conversely, drop traffic intended for edge hosts that the controller no longer perceives as residing on boundary ports. This effectively creates a topological partition or a traffic-blackhole scenario within the SDN controller’s routing logic.\nThe vulnerability is inherent to the controller's software logic at version 71fe8a7. No authentication is required for the initial spoofing phase as the controller is designed to trust link discovery information received from managed devices. The network exposure is limited to the L2 domain of the switches managed by the Floodlight controller, meaning the attacker must be present on a segment that the controller is actively monitoring."
}