CVE-2018-1000614: Onosproject Onos

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

ONOS ONOS Controller version 1.13.1 and earlier contains a XML External Entity (XXE) vulnerability in providers/netconf/alarm/src/main/java/org/onosproject/provider/netconf/alarm/NetconfAlarmTranslator.java that can result in An adversary can remotely launch advanced XXE attacks on ONOS controller without authentication.. This attack appear to be exploitable via crafted protocol message.

Affected products

• Onosproject Onos: up to and including 1.13.1

Published 2018-07-09. Last modified 2026-06-17.