CVE-2022-29944

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of paths installed by intents. An existing intents does not redirect to a new path, even if a new intent that shares the path with higher priority is installed.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-697

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://wiki.onosproject.org/display/ONOS/Intent+FrameworkProduct
https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdfExploit, Technical Description, Third Party Advisory
https://wiki.onosproject.org/display/ONOS/Intent+FrameworkProduct
https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdfExploit, Technical Description, Third Party Advisory

Timeline

Published: Apr 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-299457.5DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope CVE-2022-299466.3NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by CVE-2022-299476.1Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.CVE-2022-299484.6Due to an insecure design, the Lepin EP-KP001 flash drive through KP001_V19 is vulnerable to an authentication bypass attack that enables an CVE-2022-29957.1Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data CVE-2022-299504.3Experian Hunter 1.16 allows remote authenticated users to modify assumed-immutable elements via the (1) rule name parameter to the Rules pag CVE-2022-299519.1JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. They utilize the CMPLink/TCP protocol (configurable on ports 1024-65534 on e CVE-2022-299529.1Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (6 CVE-2022-299539.8The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocum CVE-2022-299577.8The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols CVE-2022-299589.8JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering pu CVE-2022-299595.5Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock l