Fabric Engine (VOSS) CVE-2025-11192

Exploitation requires that SD-WAN AutoSense be enabled on a port (a non-default feature-specific configuration) on Fabric Engine (VOSS) versions before 9.3; when enabled, the port auto-configures fabric connectivity without validating ISIS authentication settings, which is the core defect. The attacker must have physical access to connect to such a port (CVSS AV:P), and no credentials are needed once connected (PR:N). Limiting factors that reduce realistic risk: physical presence at the device is mandatory, the vulnerable AutoSense mode must be explicitly turned on, and systems upgraded to 9.3 or later are not affected.

The vendor-provided CVSS 4.0 base score of 8.4 (High) is driven by high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H), reflecting that a successful attack yields unauthorized access to the ISIS network fabric and its configuration data. However, the single most important mitigating signal is the attack vector: the CVSS vector specifies AV:P (physical), meaning the attacker must physically connect to an affected port - this dramatically narrows real-world exploitability compared to a network-exploitable flaw. The vector is also unauthenticated (PR:N) with low complexity (AC:L) and no user interaction (UI:N), consistent with the CWE-287 authentication-bypass classification: once physical access to an AutoSense-enabled port is achieved, exploitation is straightforward. There is NO EPSS score, NO CISA KEV listing, and NO public proof-of-concept in the provided data, so there is no evidence of active or probable exploitation - this is currently a high-severity-rating issue whose practical risk is constrained by the physical access requirement and the non-default SD-WAN AutoSense configuration. Note a tension worth flagging: the 'Authentication Bypass' tag and the description's phrase 'exploited by malicious actors' could suggest remote abuse, but the authoritative CVSS vector states physical access (AV:P) - verify the required access mode with Extreme Networks before treating this as remotely exploitable.

An attacker with physical access to an Extreme Networks Fabric Engine (VOSS) switch port on which SD-WAN AutoSense is enabled connects a rogue device; the port automatically provisions fabric connectivity without validating ISIS authentication settings, letting the attacker join the fabric and read or alter configuration data. Exploitation requires physical port access (CVSS AV:P) and low complexity (AC:L) with no authentication (PR:N), but is limited to ports where AutoSense is actually enabled. No public exploit code is identified at time of analysis.