M. Diouf

Moustapha Awwalou Diouf, Samuel Ouya, Jacques Klein et al.

Software-defined networking (SDN) separates the control plane from the data plane and exposes the network through software applications and open APIs. The same programmability that drove its adoption also turned the network into a large body of software, and that software can be vulnerable. Knowing where and how SDN software fails is a prerequisite for defending it, yet the literature offers no consolidated account of the problem. We address this gap with a systematic literature review of 113 primary studies published between 2012 and 2025 on the security of the software that makes up SDN. We study how each software component becomes vulnerable, how attackers exploit it, which testing and analysis techniques expose its defects, and how the field has evolved. The review yields a taxonomy of vulnerabilities and attack vectors organized by SDN software component, a synthesis of the methods used to find software defects in each component, and a set of open problems that mark the most promising directions for future work. Earlier surveys treat SDN security as a networking problem; ours is, to our knowledge, the first to treat SDN components as software artifacts whose code, logic, and interactions can be defective. Our artifacts are available at https://github.com/mad975/SDNSoftwareSecurity_SLR.

Moustapha Awwalou Diouf, Maimouna Tamah Diao, Iyiola Emmanuel Olatunji et al.

LLMs democratize software engineering by enabling non-programmers to create applications, but this same accessibility fundamentally undermines security assumptions that have guided software engineering for decades. We show in this work how publicly available LLMs can be socially engineered to transform novices into capable attackers, challenging the foundational principle that exploitation requires technical expertise. To that end, we propose RSA (Role-assignment, Scenario-pretexting, and Action-solicitation), a pretexting strategy that manipulates LLMs into generating functional exploits despite their safety mechanisms. Testing against Odoo -- a widely used ERP platform, we evaluated five mainstream LLMs (GPT-4o, Gemini, Claude, Microsoft Copilot, and DeepSeek) and successfully exploited every tested CVE: at least one LLM produced a functional exploit for each within 3-5 prompting rounds. While prior work~\cite{jin2025good} found LLM-assisted attacks difficult and requiring manual effort, we demonstrate that this overhead can be eliminated entirely. Our findings invalidate core software engineering security principles: the distinction between technical and non-technical actors no longer provides valid threat models; technical complexity of vulnerability descriptions offers no protection when LLMs can abstract it away; and traditional security boundaries dissolve when the same tools that build software can be manipulated to break it. This represents a paradigm shift in software engineering -- we must redesign security practices for an era where exploitation requires only the ability to craft prompts, not understand code. Artifacts available at: https://anonymous.4open.science/r/From-Rookie-to-Attacker-D8B3.