EUVD-2026-46047
GHSA-mxjh-p6gq-89p9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for the required low-privilege account and AC:H because challenge prediction succeeds only 'under certain conditions'; root escalation yields full C/I/A on the device.
Primary rating from Vendor (ExtremeNetworks).
CVSS VectorVendor: ExtremeNetworks
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode without authorization. Depending on device configuration and version, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation requires either a valid low-privilege account on the device (remote scenario) or physical serial console access (local scenario). This vulnerability is distinct from CVE-2017-14329, which addressed a different issue involving Python script privileges.
AnalysisAI
Privilege escalation in Extreme Networks ExtremeXOS (EXOS / Switch Engine) lets an attacker reach the privileged debug-mode function because its challenge-response authorization derives the challenge from an insufficiently random source (CWE-338), making the expected response predictable under certain conditions. An attacker holding a valid low-privilege account (remote) or physical serial console access (local) can bypass debug-mode authorization and, depending on device model and firmware, escalate to root and persistently modify the device software stack. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the vendor (Extreme Networks) self-reported the issue.
Technical ContextAI
ExtremeXOS is the network operating system running on Extreme Networks Ethernet switches (the affected CPE is cpe:2.3:a:extreme_networks:switch_engine_(exos)). Access to the hidden 'debug-mode' shell - an engineering/support facility that exposes low-level system functions - is gated by a challenge-response handshake: the device presents a challenge and the operator must supply the matching response. The root cause is CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator): the challenge value is produced from a source with insufficient entropy, so an attacker who can observe or reason about the generator's state can predict future challenges and therefore precompute the valid response without possessing the intended secret. Because debug-mode sits below the normal CLI privilege model, successfully activating it can bridge from a constrained account (or serial console) to root-level control of the underlying OS and firmware. The vendor explicitly notes this is a separate defect from CVE-2017-14329, which concerned Python script privileges rather than the challenge generation itself.
RemediationAI
No vendor-released patch version is identified in the available data - consult Extreme Networks' product security portal (https://www.extremenetworks.com/support/policies/product-security) for the model- and firmware-specific advisory and upgrade to the fixed ExtremeXOS/Switch Engine build once published; do not deploy an invented version number. Until a fix is applied, reduce exposure of both attack paths: restrict and audit low-privilege management accounts (enforce strong per-user authentication, remove shared/default logins, and apply RBAC so untrusted operators cannot log in at all), which removes the remote precondition (PR:L); place switch management interfaces on an isolated out-of-band management VLAN/ACL so only trusted administrators can reach the CLI, at the cost of tighter operational access; and physically secure the console/serial ports (locked racks, disabled or password-gated console access) to close the local path, with the trade-off of slower emergency console recovery. Monitor for unexpected debug-mode activation or firmware/software-stack changes as a detective control.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today