A flaw in the NAC administration interface of ExtremeCloud IQ – Site Engine enables an authenticated administrator to receive HTTP responses containing fully resolved credential values, despite the UI showing masked entries. The attacker can thus recover stored secrets that are intended to be protected. This constitutes a direct disclosure of sensitive authentication data, potentially allowing privilege escalation within the network visibility and control plane.

Extreme Networks’ ExtremeCloud IQ – Site Engine, versions prior to 26.2.10. The vulnerability was fixed in 26.2.10 and later releases.

The CVSS score of 6 indicates moderate severity. EPSS is less than 1%, suggesting low current exploitation probability, but the issue is not listed in CISA’s KEV. Because the exploit requires an authenticated NAC administrator, the attack is limited to privileged users. Nonetheless, compromised credentials could lead to broad lateral movement or control over network devices. Organizations should treat this as a moderate risk that warrants prompt remediation.