ExtremeXOS EUVD-2026-46047

Exploitation requires one of two concrete preconditions: (remote) a valid low-privilege account on the ExtremeXOS device to reach the CLI where the debug-mode challenge-response is invoked, matching the CVSS PR:L; or (local) physical serial console access to the switch. Beyond the foothold, success is gated on the weak-RNG challenge being predictable, which the vendor limits to 'under certain conditions,' and the full root-escalation/persistence impact is limited to specific device configurations and firmware versions ('depending on device configuration and version'). Limiting factors for defenders: no unauthenticated remote path (an account or physical access is mandatory), no default-config guarantee that prediction succeeds, and version/model-dependent outcomes - so environments that tightly control switch logins and console ports face substantially lower realistic risk.

The vendor CVSS 4.0 score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, reflecting full confidentiality/integrity/availability loss of the vulnerable device with only a low-privilege account required and no user interaction. Tempering that raw score: the description hedges the predictability with 'under certain conditions' and 'depending on device configuration and version,' which argues for higher real-world attack complexity than the AC:L in the vendor vector suggests - a defender should treat exploitability as conditional, not guaranteed. Key exploitation signals are absent: no EPSS score, KEV status, POC, or SSVC decision data were provided, and the sole reference is Extreme's general product-security policy page rather than a specific advisory with affected builds. The remote path still requires an authenticated foothold (PR:L), and the local path requires physical serial access, both of which meaningfully raise the bar versus an unauthenticated network exploit. Net: this is a genuine escalation-to-root primitive worth prioritizing on Extreme switches reachable by semi-trusted users, but the conditional predictability and missing exploitation telemetry make it a targeted/insider-leaning risk rather than a mass-exploitation emergency. Verify affected versions and fix builds directly with Extreme before finalizing patch windows.

An attacker with a low-privilege ExtremeXOS operator account (for example a limited NOC or contractor login) logs into the switch CLI, repeatedly requests the debug-mode challenge, and - because the challenge derives from a weak PRNG - predicts the expected response to unlock debug-mode without the intended secret. From debug-mode they escalate to root and persistently backdoor the device firmware. No public POC has been identified, and the alternative path requires physical serial console access to the switch.