Switch Engine Exos
Monthly
Privilege escalation in Extreme Networks ExtremeXOS (Switch Engine) EXOS shell allows a low-privileged CLI user to abuse the built-in mv, cp, and rm utilities to escape their authorized filesystem scope and tamper with security-critical files. Because these utilities follow symbolic links without safely canonicalizing paths, an attacker can plant a symlink to a privileged location and, under certain conditions, escalate to root and persistently modify the device software stack. Reported by Extreme Networks with a CVSS 4.0 score of 8.7 (High); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Extreme Networks ExtremeXOS (EXOS / Switch Engine) lets an attacker reach the privileged debug-mode function because its challenge-response authorization derives the challenge from an insufficiently random source (CWE-338), making the expected response predictable under certain conditions. An attacker holding a valid low-privilege account (remote) or physical serial console access (local) can bypass debug-mode authorization and, depending on device model and firmware, escalate to root and persistently modify the device software stack. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the vendor (Extreme Networks) self-reported the issue.
Privilege escalation in Extreme Networks ExtremeXOS (Switch Engine) EXOS shell allows a low-privileged CLI user to abuse the built-in mv, cp, and rm utilities to escape their authorized filesystem scope and tamper with security-critical files. Because these utilities follow symbolic links without safely canonicalizing paths, an attacker can plant a symlink to a privileged location and, under certain conditions, escalate to root and persistently modify the device software stack. Reported by Extreme Networks with a CVSS 4.0 score of 8.7 (High); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in Extreme Networks ExtremeXOS (EXOS / Switch Engine) lets an attacker reach the privileged debug-mode function because its challenge-response authorization derives the challenge from an insufficiently random source (CWE-338), making the expected response predictable under certain conditions. An attacker holding a valid low-privilege account (remote) or physical serial console access (local) can bypass debug-mode authorization and, depending on device model and firmware, escalate to root and persistently modify the device software stack. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the vendor (Extreme Networks) self-reported the issue.