CVE-2026-105440
Switch Engine (EXOS) JSON-RPC Authorization Bypass Allows Read-Only Users to Disclose Sensitive Information
Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authenticated, low-privileged (read-only) user to execute CLI show commands that are restricted to that role through the command line interface. Successful exploitation results in disclosure of sensitive information, including the device configuration and the password hashes of local accounts. Configuration, enable, and debug commands are not affected. Disclosed password hashes can be attacked offline, and a weak password could lead to administrative access to the device. This issue is fixed in Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, and 32.7.4.15-patch1-11. Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure.
Fixes and workarounds
Fix
Upgrade to Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, or 32.7.4.15-patch1-11, or later.After upgrading, rotate local account passwords, especially administrative accounts.
Source: CNA: ExtremeNetworksWorkaround
Restrict access to the device management interface to trusted networks and hosts. Disable the web services (JSON-RPC) interface where it is not required. Limit read-only accounts to users who require them, and enforce strong, unique passwords on all local accounts.
Source: CNA: ExtremeNetworksAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Switch Engine (EXOS) Extreme Networks |
≥ 33.7.0; < 33.7.1-patch1-11 (affected, custom) ≥ 33.1.0; < 33.1.100-patch1-9 (affected, custom) ≥ 32.0.0; < 32.7.4.15-patch1-11 (affected, custom) Other versions: unaffected |
CNA: ExtremeNetworks |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 8.3 high |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | CNA: ExtremeNetworks |
| 3.1 / 6.5 medium |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | CNA: ExtremeNetworks |
| 4.0 / 8.3 high |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD: 1c053176-eef3-4d6a-ae0b-24728c86587b |
| 3.1 / 6.5 medium |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD: 1c053176-eef3-4d6a-ae0b-24728c86587b |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://extreme-networks.my.site.com/ExtrArticleDetail?an=000140004CNA: ExtremeNetworks
- https://extreme-networks.my.site.com/ExtrArticleDetail?an=0001400041c053176-eef3-4d6a-ae0b-24728c86587b
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.