Missing Authorization in Extreme Networks Switch Engine Exposes Sensitive Data
CVE-2026-105440

8.3HIGH

Key Information:

Vendor

Extreme Networks

Status
Switch Engine (exos)
Vendor
CVE Published:
11 November 2026

What is CVE-2026-105440?

A vulnerability in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) presents a significant risk by allowing low-privileged users to execute restricted CLI show commands. This exploitation leads to the unintended disclosure of sensitive information, such as device configurations and password hashes of local accounts. Although commands for configuration, enable, and debug remain unaffected, the revealed password hashes can be compromised offline. If weak passwords are used, unauthorized administrative access to the device is possible. The issue has been addressed in recent patches, ensuring enhanced security.

Affected Version(s)

Switch Engine (EXOS) 33.7.0 < 33.7.1-patch1-11

Switch Engine (EXOS) 33.1.0 < 33.1.100-patch1-9

Switch Engine (EXOS) 32.0.0 < 32.7.4.15-patch1-11

References

https://extreme-networks.my.site.com/ExtrArticleDetail?an...

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Toàn Lê (https://github.com/toanln-cov)
.