PT-2025-32588

CVE-2025-54992

Published

2025-08-11

Updated

2025-08-11

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: OpenKilda versions prior to 1.164.0

Description: OpenKilda, an open-source OpenFlow controller, contains an XML external entity (XXE) injection vulnerability. This vulnerability, in combination with GHSL-2025-024, allows unauthenticated attackers to exfiltrate information from the instance where the OpenKilda UI is running, potentially leading to information disclosure.

Recommendations: Update to version 1.164.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

P-

Vendors

Affected products

Weakness enumeration

CWE-611: Improper Restriction of XML External Entity Reference

Related identifiers