CVE-2025-30077

Published Mar 16, 2025 CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Description

Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of numBits.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

onosproject

onos-lib-go

unknown

Version	Status	Constraints
`0.10.28`	affected	—

No data.

No data available yet.

No solution or workaround provided in the CVE record

Source	ID	Title
EUVD	EUVD-2025-6566	Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of numBits.
Github GHSA	GHSA-jrqj-6vq2-7r63	onos-lib-go allows an index out-of-range panic

No CVSS v4.0

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.160% probability within 30 days)

References

Link	Providers
https://github.com/onosproject/onos-lib-go/issues/295

History

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00019}`	epss `{'score': 0.00027}`

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of numBits.
Weaknesses		CWE-129
References		https://github.com/onosproject/onos-lib-go/issues/295
Metrics		cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`