Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    8 vulnerabilities

    CVE-2026-8170 (GCVE-0-2026-8170)

    Vulnerability from cvelistv5 – Published: 2026-07-20 17:34 – Updated: 2026-07-20 19:21
    VLAI
    Title
    ExtremeXOS Privilege Escalation via Symlink Following in File Utilities
    Summary
    The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic link that references a privileged filesystem location and then invoke the affected utilities to read, modify, or replace security-critical files outside of their authorized scope. Under certain conditions, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation is possible remotely by an attacker holding a low-privilege account, or locally via the serial console. Extreme would like to thank Hadrien Barral (Université Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-07-20 18:26 UTC
    CWE
    • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Extreme Networks Switch Engine (EXOS) Affected: 0 , < 31.7.4 (custom)
    Affected: 32.0.0 , < 32.7.4.15 (custom)
    Affected: 33.0.0 , < 33.1.100 (custom)
    Affected: 33.2.0 , < 33.7.1 (custom)
    		Create a notification for this product.
    Credits
    Extreme would like to thank Hadrien Barral (Université Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8170",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T18:26:34.100325Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T18:26:44.179Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Switch Engine"
          ],
          "product": "Switch Engine (EXOS)",
          "vendor": "Extreme Networks",
          "versions": [
            {
              "lessThan": "31.7.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "32.7.4.15",
              "status": "affected",
              "version": "32.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "33.1.100",
              "status": "affected",
              "version": "33.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "33.7.1",
              "status": "affected",
              "version": "33.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Extreme would like to thank Hadrien Barral (Universit\u00e9 Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic link that references a privileged filesystem location and then invoke the affected utilities to read, modify, or replace security-critical files outside of their authorized scope. Under certain conditions, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation is possible remotely by an attacker holding a low-privilege account, or locally via the serial console.\u003c/p\u003e\u003cp\u003eExtreme would like to thank Hadrien Barral (Universit\u00e9 Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.\u003c/p\u003e"
            }
          ],
          "value": "The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic link that references a privileged filesystem location and then invoke the affected utilities to read, modify, or replace security-critical files outside of their authorized scope. Under certain conditions, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation is possible remotely by an attacker holding a low-privilege account, or locally via the serial console.\n\n\n\nExtreme would like to thank Hadrien Barral (Universit\u00e9 Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-20T19:21:08.881Z",
        "orgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
        "shortName": "ExtremeNetworks"
      },
      "references": [
        {
          "name": "Extreme Networks Product Security",
          "url": "https://www.extremenetworks.com/support/policies/product-security"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eExtreme Networks has released fixed versions of Switch Engine (EXOS) that address this vulnerability. Customers should upgrade to one of the following releases or later: 31.7.4, 32.7.4.15, 33.1.100, or 33.7.1.\u003c/p\u003e"
            }
          ],
          "value": "Extreme Networks has released fixed versions of Switch Engine (EXOS) that address this vulnerability. Customers should upgrade to one of the following releases or later: 31.7.4, 32.7.4.15, 33.1.100, or 33.7.1."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ExtremeXOS Privilege Escalation via Symlink Following in File Utilities",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eWhere immediate upgrade is not feasible, customers should: (1) restrict CLI access to trusted administrators only; (2) enforce strong authentication and rotate any default credentials; (3) restrict physical access to serial console ports; and (4) monitor device logs for anomalous shell activity and filesystem modifications.\u003c/p\u003e"
            }
          ],
          "value": "Where immediate upgrade is not feasible, customers should: (1) restrict CLI access to trusted administrators only; (2) enforce strong authentication and rotate any default credentials; (3) restrict physical access to serial console ports; and (4) monitor device logs for anomalous shell activity and filesystem modifications."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
    "assignerShortName": "ExtremeNetworks",
    "cveId": "CVE-2026-8170",
    "datePublished": "2026-07-20T17:34:10.950Z",
    "dateReserved": "2026-05-08T12:59:11.022Z",
    "dateUpdated": "2026-07-20T19:21:08.881Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-8169 (GCVE-0-2026-8169)

    Vulnerability from cvelistv5 – Published: 2026-07-20 17:33 – Updated: 2026-07-20 19:20
    VLAI
    Title
    ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNG
    Summary
    ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode without authorization. Depending on device configuration and version, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation requires either a valid low-privilege account on the device (remote scenario) or physical serial console access (local scenario). This vulnerability is distinct from CVE-2017-14329, which addressed a different issue involving Python script privileges. Extreme would like to thank Hadrien Barral (Université Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-07-20 18:26 UTC
    CWE
    • CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Extreme Networks Switch Engine (EXOS) Affected: 0 , < 31.7.4 (custom)
    Affected: 32.0.0 , < 32.7.4.15 (custom)
    Affected: 33.0.0 , < 33.1.100 (custom)
    Affected: 33.2.0 , < 33.7.1 (custom)
    		Create a notification for this product.
    Date Public
    2026-07-20 17:27
    Credits
    Extreme would like to thank Hadrien Barral (Université Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8169",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T18:26:07.254983Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T18:26:18.638Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Switch Engine"
          ],
          "product": "Switch Engine (EXOS)",
          "vendor": "Extreme Networks",
          "versions": [
            {
              "lessThan": "31.7.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "32.7.4.15",
              "status": "affected",
              "version": "32.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "33.1.100",
              "status": "affected",
              "version": "33.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "33.7.1",
              "status": "affected",
              "version": "33.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Extreme would like to thank Hadrien Barral (Universit\u00e9 Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings."
        }
      ],
      "datePublic": "2026-07-20T17:27:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode without authorization. Depending on device configuration and version, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation requires either a valid low-privilege account on the device (remote scenario) or physical serial console access (local scenario). This vulnerability is distinct from CVE-2017-14329, which addressed a different issue involving Python script privileges.\u003c/p\u003e\u003cp\u003eExtreme would like to thank Hadrien Barral (Universit\u00e9 Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.\u003c/p\u003e"
            }
          ],
          "value": "ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode without authorization. Depending on device configuration and version, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation requires either a valid low-privilege account on the device (remote scenario) or physical serial console access (local scenario). This vulnerability is distinct from CVE-2017-14329, which addressed a different issue involving Python script privileges.\n\n\n\nExtreme would like to thank Hadrien Barral (Universit\u00e9 Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-338",
              "description": "CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-20T19:20:47.552Z",
        "orgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
        "shortName": "ExtremeNetworks"
      },
      "references": [
        {
          "name": "Extreme Networks Product Security",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.extremenetworks.com/support/policies/product-security"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eExtreme Networks has released fixed versions of Switch Engine (EXOS) that address this vulnerability. Customers should upgrade to one of the following releases or later: 31.7.4, 32.7.4.15, 33.1.100, or 33.7.1.\u003c/p\u003e"
            }
          ],
          "value": "Extreme Networks has released fixed versions of Switch Engine (EXOS) that address this vulnerability. Customers should upgrade to one of the following releases or later: 31.7.4, 32.7.4.15, 33.1.100, or 33.7.1."
        }
      ],
      "source": {
        "advisory": "SA-2026-087",
        "discovery": "EXTERNAL"
      },
      "title": "ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNG",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eWhere immediate upgrade is not feasible, customers should: (1) restrict CLI access to trusted administrators only; (2) enforce strong authentication and rotate any default credentials; (3) restrict physical access to serial console ports; and (4) monitor device logs for unexpected debug-mode activation attempts.\u003c/p\u003e"
            }
          ],
          "value": "Where immediate upgrade is not feasible, customers should: (1) restrict CLI access to trusted administrators only; (2) enforce strong authentication and rotate any default credentials; (3) restrict physical access to serial console ports; and (4) monitor device logs for unexpected debug-mode activation attempts."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
    "assignerShortName": "ExtremeNetworks",
    "cveId": "CVE-2026-8169",
    "datePublished": "2026-07-20T17:33:05.699Z",
    "dateReserved": "2026-05-08T12:59:08.619Z",
    "dateUpdated": "2026-07-20T19:20:47.552Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-9831 (GCVE-0-2026-9831)

    Vulnerability from cvelistv5 – Published: 2026-05-29 21:19 – Updated: 2026-06-01 13:53
    VLAI
    Title
    ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition
    Summary
    A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-concurrency traffic conditions, intermittently allow requests authenticated with an Extreme Platform ONE /IAM-issued API key to receive response data for another tenant. The issue was observed through ExtremeCloud IQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE /Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT authentication were not affected.
    Severity
    6.3 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-01 13:52 UTC
    CWE
    • CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)
    • CWE-488 - Exposure of data element to wrong session
    Assigner
    References
    Impacted products
    Vendor Product Version
    Extreme Networks Extreme Platform ONE Affected: 0 , < 25.10.0-104 (custom)
    Unaffected: 25.10.0-104 (custom)
    		Create a notification for this product.
    Date Public
    2026-05-29 21:09
    Credits
    Sebastian Koller of Iteas IT Services GmbH (Austria) for responsible discovery and disclosure of this vulnerability. Sebastian Koller of Iteas IT Services GmbH (Austria) for responsible coordination and providing detailed evidence supporting root cause identification.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9831",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T13:52:52.575235Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-01T13:53:05.140Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "SaaS (Cloud Hosted)"
          ],
          "product": "Extreme Platform ONE",
          "vendor": "Extreme Networks",
          "versions": [
            {
              "lessThan": "25.10.0-104",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "25.10.0-104",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sebastian Koller of Iteas IT Services GmbH (Austria) for responsible discovery and disclosure of this vulnerability."
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Sebastian Koller of Iteas IT Services GmbH (Austria) for responsible coordination and providing detailed evidence supporting root cause identification."
        }
      ],
      "datePublic": "2026-05-29T21:09:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected."
            }
          ],
          "value": "A race condition in the shared Extreme Platform\nONE IAM Gateway API-key authentication path could, under specific\nhigh-concurrency traffic conditions, intermittently allow requests\nauthenticated with an Extreme Platform ONE /IAM-issued API key to receive\nresponse data for another tenant. The issue was observed through ExtremeCloud\nIQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE\n/Common Services API paths. XIQ-native tokens and standard OAuth/Bearer JWT\nauthentication were not affected."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-74",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-74: Manipulating State"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-488",
              "description": "CWE-488 Exposure of data element to wrong session",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T21:19:17.118Z",
        "orgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
        "shortName": "ExtremeNetworks"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2026-048-extremecloud-iq-cross-tenant-data-exposure-via/ba-p/121851"
        }
      ],
      "source": {
        "advisory": "SA-2026-048",
        "discovery": "EXTERNAL"
      },
      "title": "ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
    "assignerShortName": "ExtremeNetworks",
    "cveId": "CVE-2026-9831",
    "datePublished": "2026-05-29T21:19:17.118Z",
    "dateReserved": "2026-05-28T12:21:45.520Z",
    "dateUpdated": "2026-06-01T13:53:05.140Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-0689 (GCVE-0-2026-0689)

    Vulnerability from cvelistv5 – Published: 2026-03-02 15:16 – Updated: 2026-03-02 19:17
    VLAI
    Title
    XIQ‑SE NAC Admin Credential Exposure via HTTP Response
    Summary
    In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the user interface, the application returns the underlying credential values in the HTTP response, enabling an authorized administrator to recover stored secrets that may exceed their intended access. We would like to thank the Lockheed Martin Red Team for responsibly reporting this issue and working with us through coordinated disclosure.
    Severity
    6 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-03-02 19:17 UTC
    CWE
    • CWE-522 - Insufficiently Protected Credentials
    Assigner
    References
    Impacted products
    Vendor Product Version
    Extreme Networks ExtremeCloud IQ - Site Engine Affected: 25.5.12.6 , ≤ <=25.12.11 (custom)
    		Create a notification for this product.
    Date Public
    2026-03-02 14:07
    Credits
    Lockheed Martin Red Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0689",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-02T19:17:27.896047Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-02T19:17:37.551Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ExtremeCloud IQ - Site Engine",
          "vendor": "Extreme Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "26.02.11",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "\u003c=25.12.11",
              "status": "affected",
              "version": "25.5.12.6",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "NAC administrator privlege required.\u0026nbsp;"
            }
          ],
          "value": "NAC administrator privlege required."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Lockheed Martin Red Team"
        }
      ],
      "datePublic": "2026-03-02T14:07:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgba(206, 206, 217, 0.004);\"\u003eIn ExtremeCloud IQ \u2013 Site Engine (XIQ\u2011SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the user interface, the application returns the underlying credential values in the HTTP response, enabling an authorized administrator to recover stored secrets that may exceed their intended access.\n\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e\nWe would like to thank the Lockheed Martin Red Team for responsibly reporting this issue and working with us through coordinated disclosure.\u003c/span\u003e"
            }
          ],
          "value": "In ExtremeCloud IQ \u2013 Site Engine (XIQ\u2011SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the user interface, the application returns the underlying credential values in the HTTP response, enabling an authorized administrator to recover stored secrets that may exceed their intended access.\n\n\n\n\nWe would like to thank the Lockheed Martin Red Team for responsibly reporting this issue and working with us through coordinated disclosure."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "UNREPORTED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-02T16:38:23.688Z",
        "orgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
        "shortName": "ExtremeNetworks"
      },
      "references": [
        {
          "url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000134325"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgba(206, 206, 217, 0.02);\"\u003eFixed in 26.2.10 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Fixed in 26.2.10 or later."
        }
      ],
      "source": {
        "advisory": "SA-2026-020",
        "discovery": "UNKNOWN"
      },
      "title": "XIQ\u2011SE NAC Admin Credential Exposure via HTTP Response",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
    "assignerShortName": "ExtremeNetworks",
    "cveId": "CVE-2026-0689",
    "datePublished": "2026-03-02T15:16:44.054Z",
    "dateReserved": "2026-01-07T20:12:47.064Z",
    "dateUpdated": "2026-03-02T19:17:37.551Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-11192 (GCVE-0-2025-11192)

    Vulnerability from cvelistv5 – Published: 2025-10-07 19:07 – Updated: 2025-10-08 15:45
    VLAI
    Title
    Fabric Engine (VOSS) AutoSense Authentication Bypass
    Summary
    A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure fabric connectivity without validating ISIS authentication settings. The SD-WAN AutoSense implementation may be exploited by malicious actors by allowing unauthorized access to network fabric and configuration data.
    Severity
    8.4 (High)
    CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-10-08 15:45 UTC
    CWE
    • CWE-287 - Improper Authentication
    Assigner
    References
    Impacted products
    Vendor Product Version
    Extreme Networks Fabric Engine (VOSS) Affected: 9.2 , ≤ <9.2 (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11192",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-08T15:45:45.732039Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-08T15:45:56.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Fabric Engine (VOSS)",
          "vendor": "Extreme Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "9.3",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "\u003c9.2",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003eA vulnerability in Extreme Networks\u2019 Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure fabric connectivity without validating ISIS authentication settings. The SD-WAN AutoSense implementation may be exploited by malicious actors by allowing unauthorized access to network fabric and configuration data.\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cbr\u003e"
            }
          ],
          "value": "A vulnerability in Extreme Networks\u2019 Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure fabric connectivity without validating ISIS authentication settings. The SD-WAN AutoSense implementation may be exploited by malicious actors by allowing unauthorized access to network fabric and configuration data."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "PHYSICAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-07T19:07:45.086Z",
        "orgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
        "shortName": "ExtremeNetworks"
      },
      "references": [
        {
          "url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000130291"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eFixed in 9.3 or later.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Fixed in 9.3 or later."
        }
      ],
      "source": {
        "advisory": "SA-2025-115",
        "discovery": "USER"
      },
      "title": "Fabric Engine (VOSS) AutoSense Authentication Bypass",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
    "assignerShortName": "ExtremeNetworks",
    "cveId": "CVE-2025-11192",
    "datePublished": "2025-10-07T19:07:45.086Z",
    "dateReserved": "2025-09-30T13:38:06.105Z",
    "dateUpdated": "2025-10-08T15:45:56.015Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-8679 (GCVE-0-2025-8679)

    Vulnerability from cvelistv5 – Published: 2025-10-01 17:19 – Updated: 2025-10-01 17:29
    VLAI
    Title
    ExtremeGuest Essentials Captive Portal Unauthenticated Brute Force
    Summary
    In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access. Client360 logs may display the client MAC as the username despite no MAC-authentication being enabled.
    Severity
    7.6 (High)
    CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-10-01 17:29 UTC
    CWE
    • CWE-307 - Improper Restriction of Excessive Authentication Attempts
    Assigner
    References
    Impacted products
    Date Public
    2025-10-01 17:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8679",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T17:29:33.624086Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T17:29:42.134Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "ExtremeGuest Essentials",
          "vendor": "Extreme Networks",
          "versions": [
            {
              "status": "affected",
              "version": "25.4.0"
            }
          ]
        }
      ],
      "datePublic": "2025-10-01T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003eIn ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access. Client360 logs may display the client MAC as the username despite no MAC-authentication being enabled.\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access. Client360 logs may display the client MAC as the username despite no MAC-authentication being enabled."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-112",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-112 Brute Force"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-01T17:19:16.743Z",
        "orgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
        "shortName": "ExtremeNetworks"
      },
      "references": [
        {
          "url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000130289"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eFixed in 25.5.0 or later.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "Fixed in 25.5.0 or later."
        }
      ],
      "source": {
        "advisory": "SA-2025-114",
        "discovery": "USER"
      },
      "title": "ExtremeGuest Essentials Captive Portal Unauthenticated Brute Force",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
    "assignerShortName": "ExtremeNetworks",
    "cveId": "CVE-2025-8679",
    "datePublished": "2025-10-01T17:19:16.743Z",
    "dateReserved": "2025-08-06T18:32:44.244Z",
    "dateUpdated": "2025-10-01T17:29:42.134Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-6235 (GCVE-0-2025-6235)

    Vulnerability from cvelistv5 – Published: 2025-07-21 14:07 – Updated: 2025-07-21 20:03
    VLAI
    Title
    ExtremeControl (NAC) 'onmouseover' XSS
    Summary
    In ExtremeControl before 25.5.12, a cross-site scripting (XSS) vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's browser under specific interaction conditions. Successful exploitation could lead to exposure of user data or unauthorized actions within the browser context.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-07-21 14:43 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Extreme Networks ExtremeControl Affected: 25.2.12 , < 25.5.11 (custom)
    		Create a notification for this product.
    Date Public
    2025-07-21 14:03
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-6235",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-21T14:43:41.659768Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-21T14:43:50.804Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ExtremeControl",
          "vendor": "Extreme Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "25.5.12",
                  "status": "unaffected"
                }
              ],
              "lessThan": "25.5.11",
              "status": "affected",
              "version": "25.2.12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2025-07-21T14:03:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIn ExtremeControl before 25.5.12, a cross-site scripting (XSS) vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user\u0027s browser under specific interaction conditions. Successful exploitation could lead to exposure of user data or unauthorized actions within the browser context.\u003c/span\u003e"
            }
          ],
          "value": "In ExtremeControl before 25.5.12, a cross-site scripting (XSS) vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user\u0027s browser under specific interaction conditions. Successful exploitation could lead to exposure of user data or unauthorized actions within the browser context."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-21T20:03:49.151Z",
        "orgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
        "shortName": "ExtremeNetworks"
      },
      "references": [
        {
          "url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000128019"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Fixed in 25.5.12 or later."
            }
          ],
          "value": "Fixed in 25.5.12 or later."
        }
      ],
      "source": {
        "advisory": "SA-2025-073",
        "discovery": "UNKNOWN"
      },
      "title": "ExtremeControl (NAC) \u0027onmouseover\u0027 XSS",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
    "assignerShortName": "ExtremeNetworks",
    "cveId": "CVE-2025-6235",
    "datePublished": "2025-07-21T14:07:41.882Z",
    "dateReserved": "2025-06-18T13:40:51.983Z",
    "dateUpdated": "2025-07-21T20:03:49.151Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-6083 (GCVE-0-2025-6083)

    Vulnerability from cvelistv5 – Published: 2025-06-13 21:06 – Updated: 2025-06-17 18:14
    VLAI
    Title
    ExtremeCloud Universal ZTNA Improper Authorization
    Summary
    In ExtremeCloud Universal ZTNA, a syntax error in the 'searchKeyword' condition caused queries to bypass the owner_id filter. This issue may allow users to search data across the entire table instead of being restricted to their specific owner_id.
    Severity
    5.2 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/S:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-06-17 18:13 UTC
    CWE
    • CWE-287 - Improper Authentication
    Assigner
    References
    Impacted products
    Date Public
    2025-06-13 18:06
    Credits
    Bert Verschaeve Kees Brouwer
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-6083",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-17T18:13:57.210189Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T18:14:09.833Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ExtremeCloud Universal ZTNA",
          "vendor": "Extreme Networks",
          "versions": [
            {
              "status": "affected",
              "version": "25.2.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Bert Verschaeve"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Kees Brouwer"
        }
      ],
      "datePublic": "2025-06-13T18:06:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In ExtremeCloud Universal ZTNA, a syntax error in the \u0027searchKeyword\u0027 condition caused queries to bypass the owner_id filter. This issue may allow users to search data across the entire table instead of being restricted to their specific owner_id."
            }
          ],
          "value": "In ExtremeCloud Universal ZTNA, a syntax error in the \u0027searchKeyword\u0027 condition caused queries to bypass the owner_id filter. This issue may allow users to search data across the entire table instead of being restricted to their specific owner_id."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NEGLIGIBLE",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/S:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-13T21:37:46.491Z",
        "orgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
        "shortName": "ExtremeNetworks"
      },
      "references": [
        {
          "url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000126912"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Fixed in 25.2.0 patch 2 or later."
            }
          ],
          "value": "Fixed in 25.2.0 patch 2 or later."
        }
      ],
      "source": {
        "advisory": "SA-2025-060",
        "discovery": "INTERNAL"
      },
      "title": "ExtremeCloud Universal ZTNA Improper Authorization",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1c053176-eef3-4d6a-ae0b-24728c86587b",
    "assignerShortName": "ExtremeNetworks",
    "cveId": "CVE-2025-6083",
    "datePublished": "2025-06-13T21:06:34.653Z",
    "dateReserved": "2025-06-13T20:14:18.135Z",
    "dateUpdated": "2025-06-17T18:14:09.833Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}