{"id":"CVE-2021-38364","aliases":["EUVD-2021-24817","GHSA-vxgw-3746-47rm"],"status":"published","title":"An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed...","description":"An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00848,"percentile":0.5859,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-697"],"published":"2023-04-20T00:00:00Z","modified":"2026-10-24T10:30:49Z","products":[{"vendor":"opennetworking","product":"onos"}],"references":[{"url":"https://opennetworking.org/onos/","tags":["x_transferred","Product","web"]},{"url":"https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf","tags":["x_transferred","Exploit","Technical Description","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38364"},{"url":"https://opennetworking.org/onos"},{"url":"https://github.com/advisories/GHSA-vxgw-3746-47rm"}],"sources":{"cve":[{"id":"CVE-2021-38364","description":"An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents.","status":"published","published":"2023-04-20T00:00:00Z","modified":"2025-02-05T15:16:33.388Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T14:33:07.349244Z"}],"euvd":[{"id":"EUVD-2021-24817","description":"An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents.","status":"published","published":"2023-04-20T00:00:00Z","modified":"2025-02-05T15:16:33Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:05.565654Z"}],"ghsa":[{"id":"GHSA-vxgw-3746-47rm","title":"An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed...","description":"An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents.","status":"published","published":"2023-04-20T15:30:25Z","modified":"2024-04-04T03:36:43Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T14:56:16.439649Z"}],"nvd":[{"id":"CVE-2021-38364","description":"An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents.","status":"published","published":"2023-04-20T13:15:06.827Z","modified":"2026-06-17T04:01:57.503Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T14:07:07.764332Z"}],"osv":[{"id":"CVE-2021-38364","description":"An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents.","status":"published","published":"2023-04-20T13:15:06.827Z","modified":"2026-10-24T10:30:49.656960551Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:20.843843Z"}]}}