of Extreme Networks Switch Engine (EXOS) allows an authenticated,
low-privileged (read-only) user to execute CLI show commands that are
restricted to that role through the command line interface. Successful
exploitation results in disclosure of sensitive information, including the
device configuration and the password hashes of local accounts. Configuration,
enable, and debug commands are not affected. Disclosed password hashes can be
attacked offline, and a weak password could lead to administrative access to
the device. This issue is fixed in Switch Engine 33.7.1-patch1-11,
33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.
Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Extreme Networks | Switch Engine (EXOS) | unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, or 32.7.4.15-patch1-11, or later.After upgrading, rotate local account passwords, especially administrative accounts.
Vendor Workaround
Restrict access to the device management interface to trusted networks and hosts. Disable the web services (JSON-RPC) interface where it is not required. Limit read-only accounts to users who require them, and enforce strong, unique passwords on all local accounts.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 11 Nov 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authenticated, low-privileged (read-only) user to execute CLI show commands that are restricted to that role through the command line interface. Successful exploitation results in disclosure of sensitive information, including the device configuration and the password hashes of local accounts. Configuration, enable, and debug commands are not affected. Disclosed password hashes can be attacked offline, and a weak password could lead to administrative access to the device. This issue is fixed in Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, and 32.7.4.15-patch1-11. Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure. | |
| Title | Switch Engine (EXOS) JSON-RPC Authorization Bypass Allows Read-Only Users to Disclose Sensitive Information | |
| Weaknesses | CWE-862 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: ExtremeNetworks
Published:
Updated: 2026-11-11T15:30:14.813Z
Reserved: 2026-10-05T13:12:24.896Z
Link: CVE-2026-105440
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-11T16:17:24.817
Modified: 2026-11-11T16:17:24.817
Link: CVE-2026-105440
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-862
Missing Authorization