Description
Missing authorization in the JSON-RPC web services interface
of Extreme Networks Switch Engine (EXOS) allows an authenticated,
low-privileged (read-only) user to execute CLI show commands that are
restricted to that role through the command line interface. Successful
exploitation results in disclosure of sensitive information, including the
device configuration and the password hashes of local accounts. Configuration,
enable, and debug commands are not affected. Disclosed password hashes can be
attacked offline, and a weak password could lead to administrative access to
the device. This issue is fixed in Switch Engine 33.7.1-patch1-11,
33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.
Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Extreme Networks | Switch Engine (EXOS) | 33.7.0 <33.7.1-patch1-11 | — |
| Extreme Networks | Switch Engine (EXOS) | 33.1.0 <33.1.100-patch1-9 | — |
| Extreme Networks | Switch Engine (EXOS) | 32.0.0 <32.7.4.15-patch1-11 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
toanln-cov/CVE-2026-105440 ★ 0 · Nov 12, 2026
Broken Access Control via JSON-RPC API — Privilege Escalation to Admin Credentials
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- WID-SEC-2026-4537 Extreme Networks ExtremeXOS: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Nov 11, 2026