Fabric Engine Voss
Monthly
Extreme Networks Fabric Engine (VOSS) before version 9.3 can be coerced into auto-configuring fabric connectivity without validating ISIS authentication whenever SD-WAN AutoSense is enabled on a port, allowing an attacker who physically connects to that port to gain unauthorized access to the network fabric and its configuration data. Exploitation requires physical presence at the switch (CVSS AV:P) and that the non-default AutoSense feature be explicitly enabled, but no credentials are needed once the attacker is connected (PR:N), and successful abuse yields high confidentiality, integrity and availability impact across both the vulnerable device and downstream systems. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; no EPSS score was supplied with the available intelligence.
Extreme Networks Fabric Engine (VOSS) before version 9.3 can be coerced into auto-configuring fabric connectivity without validating ISIS authentication whenever SD-WAN AutoSense is enabled on a port, allowing an attacker who physically connects to that port to gain unauthorized access to the network fabric and its configuration data. Exploitation requires physical presence at the switch (CVSS AV:P) and that the non-default AutoSense feature be explicitly enabled, but no credentials are needed once the attacker is connected (PR:N), and successful abuse yields high confidentiality, integrity and availability impact across both the vulnerable device and downstream systems. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; no EPSS score was supplied with the available intelligence.