CVE-2026-105440 · Infrastructure
NO FIX YET · SEE WHAT TO DO
A low-privileged read-only account on Extreme Networks Switch Engine (EXOS) can run CLI show commands through the JSON-RPC web interface that the role should block. An attacker gets the device configuration and local account password hashes, which can be cracked offline and may lead to administrative access.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any network that runs Extreme Networks Switch Engine (EXOS) with the JSON-RPC web services interface available to authenticated read-only accounts. Configuration, enable and debug commands are not affected, so the risk centres on the read-only role. Teams that run no EXOS switches can skip it.
Not affected if jsonrpc-disabled, no-exos-switches, no-read-only-accounts
Who cares exos, extreme-networks, network-switches, switch-engine
show version33.7.1-patch1-1133.1.100.133-patch1-932.7.4.15-patch1-11Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authenticated, low-privileged (read-only) user to execute CLI show commands that are restricted to that role through the command line interface. Successful exploitation results in disclosure of sensitive information, including the device configuration and the password hashes of local accounts. Configuration, enable, and debug commands are not affected. Disclosed password hashes can be attacked offline, and a weak password could lead to administrative access to the device. This issue is fixed in Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.
Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.