{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-105440", "assignerOrgId": "1c053176-eef3-4d6a-ae0b-24728c86587b", "state": "PUBLISHED", "assignerShortName": "ExtremeNetworks", "dateReserved": "2026-10-05T13:12:24.896Z", "datePublished": "2026-11-11T15:23:47.991Z", "dateUpdated": "2026-11-11T15:30:14.813Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1c053176-eef3-4d6a-ae0b-24728c86587b", "shortName": "ExtremeNetworks", "dateUpdated": "2026-11-11T15:30:14.813Z"}, "title": "Switch Engine (EXOS) JSON-RPC Authorization Bypass Allows Read-Only Users to Disclose Sensitive Information", "datePublic": "2026-11-11T15:19:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "Extreme Networks", "product": "Switch Engine (EXOS)", "versions": [{"status": "affected", "version": "33.7.0", "lessThan": "33.7.1-patch1-11", "versionType": "custom"}, {"status": "affected", "version": "33.1.0", "lessThan": "33.1.100-patch1-9", "versionType": "custom"}, {"status": "affected", "version": "32.0.0", "lessThan": "32.7.4.15-patch1-11", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Missing authorization in the JSON-RPC web services interface\nof Extreme Networks Switch Engine (EXOS) allows an authenticated,\nlow-privileged (read-only) user to execute CLI show commands that are\nrestricted to that role through the command line interface. Successful\nexploitation results in disclosure of sensitive information, including the\ndevice configuration and the password hashes of local accounts. Configuration,\nenable, and debug commands are not affected. Disclosed password hashes can be\nattacked offline, and a weak password could lead to administrative access to\nthe device. This issue is fixed in Switch Engine 33.7.1-patch1-11,\n33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.\n\n\n\n\n\n\n\n\nExtreme Networks would like to thank To\u00e0n L\u00ea (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Missing authorization in the JSON-RPC web services interface\nof Extreme Networks Switch Engine (EXOS) allows an authenticated,\nlow-privileged (read-only) user to execute CLI show commands that are\nrestricted to that role through the command line interface. Successful\nexploitation results in disclosure of sensitive information, including the\ndevice configuration and the password hashes of local accounts. Configuration,\nenable, and debug commands are not affected. Disclosed password hashes can be\nattacked offline, and a weak password could lead to administrative access to\nthe device. This issue is fixed in Switch Engine 33.7.1-patch1-11,\n33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.</p><p><br></p><p>Extreme Networks would like to thank To\u00e0n L\u00ea (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure.</p>"}]}], "references": [{"url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000140004"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "workarounds": [{"lang": "en", "value": "Restrict access to the device management interface to\ntrusted networks and hosts. Disable the web services (JSON-RPC) interface where\nit is not required. Limit read-only accounts to users who require them, and\nenforce strong, unique passwords on all local accounts.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Restrict access to the device management interface to\ntrusted networks and hosts. Disable the web services (JSON-RPC) interface where\nit is not required. Limit read-only accounts to users who require them, and\nenforce strong, unique passwords on all local accounts.</p>"}]}], "solutions": [{"lang": "en", "value": "Upgrade\nto Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, or\n32.7.4.15-patch1-11, or later.After\nupgrading, rotate local account passwords, especially administrative accounts.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade\nto Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, or\n32.7.4.15-patch1-11, or later.<div>After\nupgrading, rotate local account passwords, especially administrative accounts.</div>"}]}], "credits": [{"lang": "en", "value": "To\u00e0n L\u00ea (https://github.com/toanln-cov)", "type": "finder"}], "source": {"advisory": "SA-2026-233", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Switch Engine (EXOS)", "vendor": "Extreme Networks", "versions": [{"lessThan": "33.7.1-patch1-11", "status": "affected", "version": "33.7.0", "versionType": "custom"}, {"lessThan": "33.1.100-patch1-9", "status": "affected", "version": "33.1.0", "versionType": "custom"}, {"lessThan": "32.7.4.15-patch1-11", "status": "affected", "version": "32.0.0", "versionType": "custom"}]}], "source": "1c053176-eef3-4d6a-ae0b-24728c86587b"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing authorization in the JSON-RPC web services interface\nof Extreme Networks Switch Engine (EXOS) allows an authenticated,\nlow-privileged (read-only) user to execute CLI show commands that are\nrestricted to that role through the command line interface. Successful\nexploitation results in disclosure of sensitive information, including the\ndevice configuration and the password hashes of local accounts. Configuration,\nenable, and debug commands are not affected. Disclosed password hashes can be\nattacked offline, and a weak password could lead to administrative access to\nthe device. This issue is fixed in Switch Engine 33.7.1-patch1-11,\n33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.\n\n\n\n\n\n\n\n\nExtreme Networks would like to thank To\u00e0n L\u00ea (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure."}], "id": "CVE-2026-105440", "lastModified": "2026-11-11T16:17:24.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "1c053176-eef3-4d6a-ae0b-24728c86587b", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "1c053176-eef3-4d6a-ae0b-24728c86587b", "type": "Secondary"}]}, "published": "2026-11-11T16:17:24.817", "references": [{"source": "1c053176-eef3-4d6a-ae0b-24728c86587b", "url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000140004"}], "sourceIdentifier": "1c053176-eef3-4d6a-ae0b-24728c86587b", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "1c053176-eef3-4d6a-ae0b-24728c86587b", "type": "Secondary"}]}

{}

{}