Description
ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode without authorization. Depending on device configuration and version, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation requires either a valid low-privilege account on the device (remote scenario) or physical serial console access (local scenario). This vulnerability is distinct from CVE-2017-14329, which addressed a different issue involving Python script privileges.



Extreme would like to thank Hadrien Barral (Université Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.
Published: 2026-07-20
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The weakness lies in the use of an insufficiently random source when generating the challenge value for the debug‑mode authentication. An attacker who can predict or brute‑force the challenge can supply a valid response, allowing and potentially elevating privileges to root on the device. The ability to modify the software stack persistently escalates a low‑privilege account remotely or by accessing the serial console locally.

Affected Systems

Extreme Networks Switch Engine (EXOS) systems are impacted. The CVE affects firmware releases earlier than 31.7.4, 32.7.4.15, 33.1.100, and 33.7.1. These older releases are found on devices running earlier ExtremeXOS firmware.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7, is not listed in the CISA KEV catalogue, and its EPSS score is less than 1%. Exploitation requires the presence of a low‑privilege account or direct physical console access, but the remote scenario remains realistic for environments where the device is accessible over the network. Because the flaw enables root‑level access and potential persistent changes, the risk of compromise is high, especially if an attacker can target untrusted users or physically reach the console.

Generated by OpenCVE AI on July 30, 2026 at 18:49 UTC.

Remediation

Vendor Solution

Extreme Networks has released fixed versions of Switch Engine (EXOS) that address this vulnerability. Customers should upgrade to one of the following releases or later: 31.7.4, 32.7.4.15, 33.1.100, or 33.7.1.

Vendor Workaround

Where immediate upgrade is not feasible, customers should: (1) restrict CLI access to trusted administrators only; (2) enforce strong authentication and rotate any default credentials; (3) restrict physical access to serial console ports; and (4) monitor device logs for unexpected debug-mode activation attempts.

OpenCVE Recommended Actions

  • Upgrade to one of the fixed releases (31.7.4, 32.7.4.15, 33.1.100, or 33.7.1) or later.
  • Restrict CLI access and regularly rotate any default credentials.
  • Restrict physical access to the serial console ports.
  • Monitor device logs for unexpected debug‑mode activation attempts.

Generated by OpenCVE AI on July 30, 2026 at 18:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Extreme Networks
Extreme Networks switch Engine (exos)
Vendors & Products Extreme Networks
Extreme Networks switch Engine (exos)

Mon, 20 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode without authorization. Depending on device configuration and version, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation requires either a valid low-privilege account on the device (remote scenario) or physical serial console access (local scenario). This vulnerability is distinct from CVE-2017-14329, which addressed a different issue involving Python script privileges. ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode without authorization. Depending on device configuration and version, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation requires either a valid low-privilege account on the device (remote scenario) or physical serial console access (local scenario). This vulnerability is distinct from CVE-2017-14329, which addressed a different issue involving Python script privileges. Extreme would like to thank Hadrien Barral (Université Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.

Mon, 20 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 20 Jul 2026 18:00:00 +0000

Type Values Removed Values Added
Description ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode without authorization. Depending on device configuration and version, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation requires either a valid low-privilege account on the device (remote scenario) or physical serial console access (local scenario). This vulnerability is distinct from CVE-2017-14329, which addressed a different issue involving Python script privileges.
Title ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNG
Weaknesses CWE-338
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Extreme Networks Switch Engine (exos)
cve-icon MITRE

Status: PUBLISHED

Assigner: ExtremeNetworks

Published:

Updated: 2026-07-20T19:20:47.552Z

Reserved: 2026-05-08T12:59:08.619Z

Link: CVE-2026-8169

cve-icon Vulnrichment

Updated: 2026-07-20T18:26:13.494Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T19:00:09Z

Weaknesses
  • CWE-338

    Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)