Switch Engine (EXOS) JSON-RPC Authorization Bypass Allows Read-Only Users to Disclose Sensitive Information
Summary
| CVE | CVE-2026-105440 |
|---|---|
| State | PUBLISHED |
| Assigner | ExtremeNetworks |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-11 16:17:24 UTC |
| Updated | 2026-11-11 16:17:24 UTC |
| Description | Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authenticated, low-privileged (read-only) user to execute CLI show commands that are restricted to that role through the command line interface. Successful exploitation results in disclosure of sensitive information, including the device configuration and the password hashes of local accounts. Configuration, enable, and debug commands are not affected. Disclosed password hashes can be attacked offline, and a weak password could lead to administrative access to the device. This issue is fixed in Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, and 32.7.4.15-patch1-11. Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure. |
Risk And Classification
Primary CVSS: v4.0 8.3 HIGH from 1c053176-eef3-4d6a-ae0b-24728c86587b
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-862 | CWE-862 CWE-862 Missing Authorization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 1c053176-eef3-4d6a-ae0b-24728c86587b | Secondary | 8.3 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.3 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N |
| 3.1 | 1c053176-eef3-4d6a-ae0b-24728c86587b | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Extreme Networks | Switch Engine EXOS | affected 33.7.0 33.7.1-patch1-11 custom | Not specified |
| CNA | Extreme Networks | Switch Engine EXOS | affected 33.1.0 33.1.100-patch1-9 custom | Not specified |
| CNA | Extreme Networks | Switch Engine EXOS | affected 32.0.0 32.7.4.15-patch1-11 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| extreme-networks.my.site.com/ExtrArticleDetail | 1c053176-eef3-4d6a-ae0b-24728c86587b | extreme-networks.my.site.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Toàn Lê (https://github.com/toanln-cov) (en)
Additional Advisory Data
Solutions
CNA: Upgrade to Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, or 32.7.4.15-patch1-11, or later.After upgrading, rotate local account passwords, especially administrative accounts.
Workarounds
CNA: Restrict access to the device management interface to trusted networks and hosts. Disable the web services (JSON-RPC) interface where it is not required. Limit read-only accounts to users who require them, and enforce strong, unique passwords on all local accounts.