Extreme Networks
Monthly
Privilege escalation in Extreme Networks ExtremeXOS (Switch Engine) EXOS shell allows a low-privileged CLI user to abuse the built-in mv, cp, and rm utilities to escape their authorized filesystem scope and tamper with security-critical files. Because these utilities follow symbolic links without safely canonicalizing paths, an attacker can plant a symlink to a privileged location and, under certain conditions, escalate to root and persistently modify the device software stack. Reported by Extreme Networks with a CVSS 4.0 score of 8.7 (High); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Extreme Networks ExtremeXOS (EXOS / Switch Engine) lets an attacker reach the privileged debug-mode function because its challenge-response authorization derives the challenge from an insufficiently random source (CWE-338), making the expected response predictable under certain conditions. An attacker holding a valid low-privilege account (remote) or physical serial console access (local) can bypass debug-mode authorization and, depending on device model and firmware, escalate to root and persistently modify the device software stack. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the vendor (Extreme Networks) self-reported the issue.
Cross-tenant data exposure in Extreme Platform ONE's IAM Gateway API-key authentication path allows an authenticated API-key holder to intermittently receive response data belonging to a different tenant under high-concurrency conditions. Affected endpoints include both ExtremeCloud IQ (XIQ/XAPI) and Extreme Platform ONE Common Services API paths; XIQ-native tokens and standard OAuth/Bearer JWT authentication are explicitly confirmed unaffected. No public exploit identified at time of analysis, and no CISA KEV listing exists, but the Changed scope (S:C) in the CVSS vector confirms that successful exploitation crosses tenant isolation boundaries, elevating the real-world severity beyond the 6.3 base score for multi-tenant deployments.
Privilege escalation in Extreme Networks ExtremeXOS (Switch Engine) EXOS shell allows a low-privileged CLI user to abuse the built-in mv, cp, and rm utilities to escape their authorized filesystem scope and tamper with security-critical files. Because these utilities follow symbolic links without safely canonicalizing paths, an attacker can plant a symlink to a privileged location and, under certain conditions, escalate to root and persistently modify the device software stack. Reported by Extreme Networks with a CVSS 4.0 score of 8.7 (High); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Extreme Networks ExtremeXOS (EXOS / Switch Engine) lets an attacker reach the privileged debug-mode function because its challenge-response authorization derives the challenge from an insufficiently random source (CWE-338), making the expected response predictable under certain conditions. An attacker holding a valid low-privilege account (remote) or physical serial console access (local) can bypass debug-mode authorization and, depending on device model and firmware, escalate to root and persistently modify the device software stack. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the vendor (Extreme Networks) self-reported the issue.
Cross-tenant data exposure in Extreme Platform ONE's IAM Gateway API-key authentication path allows an authenticated API-key holder to intermittently receive response data belonging to a different tenant under high-concurrency conditions. Affected endpoints include both ExtremeCloud IQ (XIQ/XAPI) and Extreme Platform ONE Common Services API paths; XIQ-native tokens and standard OAuth/Bearer JWT authentication are explicitly confirmed unaffected. No public exploit identified at time of analysis, and no CISA KEV listing exists, but the Changed scope (S:C) in the CVSS vector confirms that successful exploitation crosses tenant isolation boundaries, elevating the real-world severity beyond the 6.3 base score for multi-tenant deployments.