CVE-2025-54992 MEDIUM

CVE-2025-54992: OpenKilda XXE in SAML configuration

Vendor Telstra
Product open-kilda
Weakness CWE-611 · XXE
Published August 11, 2025
Last update August 12, 2025
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenKilda is an open-source OpenFlow controller. Prior to version 1.164.0, an XML external entity (XXE) injection vulnerability was found in OpenKilda which in combination with GHSL-2025-024 allows unauthenticated attackers to exfiltrate information from the instance where the OpenKilda UI is running. This issue may lead to Information disclosure. This issue has been patched in version 1.164.0.

Key dates

02Disclosure timeline

August 11, 2025 CVE published
August 12, 2025 Record updated