CVE-2017-1000411

CVE-2017-1000411 is a resource exhaustion vulnerability affecting OpenDayLight Controller versions Nitrogen, Carbon, Boron, Robert Varga, and Anil Vishnoi, specifically within its OpenFlow Plugin. The flaw allows an attacker to trigger a controller shutdown by sending multiple OpenFlow flows with timeouts, causing expired flow entries to persist in the CONFIG DATASTORE and consume excessive memory. The vulnerability has a CVSSv3 score of 7.5 (HIGH), indicating a severe impact. It can be exploited remotely with low attack complexity and no user interaction (AV:N/AC:L/PR:N/UI:N), leading to a complete denial of service (A:H) for the controller. Both north-bound and south-bound attacks are possible. Currently, there is no public exploit code available in Metasploit, Nuclei, or ExploitDB, and it is not listed in CISA's Known Exploited Vulnerabilities catalog. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention or active exploitation.