Unauthorized Access Flaw in Extreme Networks' ExtremeGuest Essentials

CVE-2025-8679

What is CVE-2025-8679?

A vulnerability exists in Extreme Networks' ExtremeGuest Essentials versions prior to 25.5.0, where the captive portal may allow unauthorized access. This occurs during specific configurations of the captive portal SSID, where repeated manual login attempts can lead an unauthenticated device to be falsely recognized as authenticated, thereby gaining access to the network. Notably, Client360 logs may display the MAC address of the client as the username, despite the absence of MAC-authentication practices. This significant flaw highlights the importance of securing guest network access to prevent unauthorized entry.

References