CVE-2025-45480: Floodlight Controller DoS Vulnerability

CVE-2025-45480 Overview

CVE-2025-45480 affects Floodlight commit 71fe8a7, an open-source Software-Defined Networking (SDN) controller. The vulnerability allows an adjacent-network attacker to disrupt host communication through link spoofing. Floodlight misclassifies a port as a non-boundary port, which corrupts the controller's topology view. This weakness maps to [CWE-669] Incorrect Resource Transfer Between Spheres. The flaw impacts availability of legitimate host communication paths managed by the controller.

Critical Impact
An attacker on an adjacent network segment can inject spoofed link discovery traffic to manipulate Floodlight's port classification, disrupting host-to-host communication across the SDN fabric.

Affected Products

Floodlight SDN Controller commit 71fe8a7
Floodlight deployments using the default topology and link discovery services
SDN environments relying on Floodlight for port boundary classification

Discovery Timeline

2026-09-13 - CVE-2025-45480 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2025-45480

Vulnerability Analysis

Floodlight distinguishes between internal switch-to-switch ports and boundary ports facing hosts. Boundary ports are ports where the controller expects host traffic rather than inter-switch links. The classification is driven by Link Layer Discovery Protocol (LLDP) traffic observed on each port.

An attacker with access to an adjacent network segment can craft spoofed link discovery messages. When Floodlight processes these messages, it incorrectly promotes a host-facing port to a non-boundary (inter-switch) port. Once reclassified, the controller suppresses or reroutes traffic that would normally reach the affected host.

The issue is tracked publicly in Floodlight GitHub Issue #873.

Root Cause

The root cause is insufficient validation of link discovery input before it influences topology state, categorized under [CWE-669] Incorrect Resource Transfer Between Spheres. Floodlight trusts inbound LLDP-style messages to determine port role without verifying the authenticity of the neighbor. This allows untrusted data from an adjacent segment to cross into the trusted topology-management sphere.

Attack Vector

Exploitation requires adjacent network access and low privileges, with high attack complexity. The attacker injects forged link discovery packets on a host-facing port. Floodlight's topology manager consumes the packets and updates its internal port classification. Legitimate hosts on the misclassified port then experience disrupted communication because the controller no longer treats the port as an endpoint. No confidentiality or integrity of data is impacted directly; the primary effect is limited integrity loss of topology state that manifests as availability disruption for hosts.

No verified proof-of-concept code is published. Refer to the upstream discussion for reproduction context.

Detection Methods for CVE-2025-45480

Indicators of Compromise

Unexpected transitions of host-facing switch ports to inter-switch (non-boundary) classification in Floodlight topology logs.
LLDP or link discovery frames observed on ports that historically carried only host traffic.
Sudden loss of reachability to hosts on ports that Floodlight recently reclassified.

Detection Strategies

Baseline the expected boundary vs. non-boundary port map per switch and alert on deviations reported by the Floodlight REST API endpoint /wm/topology/links/json.
Correlate controller topology change events with packet captures on affected access ports to identify spoofed LLDP sources.
Monitor Floodlight controller logs for repeated link-add events tied to the same physical port within short intervals.

Monitoring Recommendations

Forward Floodlight controller logs and switch port-security events into a centralized analytics platform for correlation.
Enable switch-level LLDP filtering on access ports and log any dropped frames as an early signal of spoofing attempts.
Track host reachability metrics per switch port and alert when connectivity drops coincide with topology updates.

How to Mitigate CVE-2025-45480

Immediate Actions Required

Inventory Floodlight deployments and identify controllers running commit 71fe8a7 or earlier builds derived from it.
Restrict physical and logical access to network segments adjacent to Floodlight-managed switches.
Enable LLDP filtering or BPDU-guard-equivalent controls on host-facing switch ports to block untrusted link discovery frames.

Patch Information

No vendor patch is referenced in the NVD entry at time of publication. Track remediation progress in Floodlight GitHub Issue #873 and apply upstream fixes once merged. Until then, treat the controller's topology input path as untrusted from adjacent networks.

Workarounds

Statically pin boundary port assignments in the Floodlight configuration where the topology is stable, rather than relying solely on dynamic discovery.
Segment the management and data planes so that only trusted switches can deliver LLDP traffic to the controller.
Deploy 802.1X or MAC-based port authentication on access ports to prevent unauthorized devices from injecting discovery traffic.

bash

# Example: disable LLDP reception on host-facing access ports (vendor-agnostic pseudo-config)
interface range access-ports
  no lldp receive
  no lldp transmit
  spanning-tree bpduguard enable