{"id":"CVE-2026-105440","kind":"vulnerability","aliases":["CVE-2026-105440"],"related":[],"title":"Extreme Networks EXOS: read-only users can dump device config and password hashes","description":"Missing authorization in the JSON-RPC web services interface\nof Extreme Networks Switch Engine (EXOS) allows an authenticated,\nlow-privileged (read-only) user to execute CLI show commands that are\nrestricted to that role through the command line interface. Successful\nexploitation results in disclosure of sensitive information, including the\ndevice configuration and the password hashes of local accounts. Configuration,\nenable, and debug commands are not affected. Disclosed password hashes can be\nattacked offline, and a weak password could lead to administrative access to\nthe device. This issue is fixed in Switch Engine 33.7.1-patch1-11,\n33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.\n\n\n\n\n\n\n\n\nExtreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure.","summary":"A low-privileged read-only account on Extreme Networks Switch Engine (EXOS) can run CLI show commands through the JSON-RPC web interface that the role should block. An attacker gets the device configuration and local account password hashes, which can be cracked offline and may lead to administrative access.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["exos","extreme-networks","infrastructure","network-switches","switch-engine"],"not_affected_if":["jsonrpc-disabled","no-exos-switches","no-read-only-accounts"],"how_to_check":"- Look up the EXOS version running on the switch with `show version`\n- Check whether the JSON-RPC web services interface is enabled on the switch and reachable by users with read-only roles\n- Confirm whether the device is on a version listed as fixed in the sources","fix":"- Switch Engine `33.7.1-patch1-11`\n- Switch Engine `33.1.100.133-patch1-9`\n- Switch Engine `32.7.4.15-patch1-11`","status":"open","published_at":"2026-11-11T16:17:24+00:00","first_seen_at":"2026-11-11T16:28:06+00:00","triaged_at":"2026-11-11T16:29:59+00:00","updated_at":"2026-11-11T16:29:59+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-11T16:29:59Z","model":"claude-haiku-5-5","output":{"fix":"- Switch Engine `33.7.1-patch1-11`\n- Switch Engine `33.1.100.133-patch1-9`\n- Switch Engine `32.7.4.15-patch1-11`","reach":"network","title":"Extreme Networks EXOS: read-only users can dump device config and password hashes","impact":"high","summary":"A low-privileged read-only account on Extreme Networks Switch Engine (EXOS) can run CLI show commands through the JSON-RPC web interface that the role should block. An attacker gets the device configuration and local account password hashes, which can be cracked offline and may lead to administrative access.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["extreme-networks","exos","switch-engine","network-switches"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reads device config and password hashes, may gain admin","analyst_note":"Confirm whether the JSON-RPC interface is enabled by default and which EXOS releases are affected beyond the three fixed builds named in the description.","how_to_check":"- Look up the EXOS version running on the switch with `show version`\n- Check whether the JSON-RPC web services interface is enabled on the switch and reachable by users with read-only roles\n- Confirm whether the device is on a version listed as fixed in the sources","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-exos-switches","jsonrpc-disabled","no-read-only-accounts"],"who_is_affected":"Any network that runs Extreme Networks Switch Engine (EXOS) with the JSON-RPC web services interface available to authenticated read-only accounts. Configuration, enable and debug commands are not affected, so the risk centres on the read-only role. Teams that run no EXOS switches can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000811,"input_tokens":4771,"output_tokens":668,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-105440':17A,20A '-11':182C,189C '-2026':16A,19A '-9':185C '/toanln-cov)':201C '32.7.4.15':187C '33.1.100.133':183C '33.7.1':180C 'access':84B,169C 'account':39B,71B,145C 'administr':83B,168C 'affect':153C 'allow':101C 'attack':64B,159C 'authent':103C 'author':86C 'block':62B 'cli':48B,113C 'command':50B,115C,124C,150C 'config':11A 'configur':68B,138C,146C 'coordin':215C 'could':165C 'crack':77B 'cve':15A,18A 'debug':149C 'devic':10A,67B,137C,172C 'disclos':154C,204C 'disclosur':131C,216C 'dump':9A 'enabl':147C 'engin':31B,44B,99C,179C 'execut':112C 'exo':3A,21B,45B,100C 'exploit':128C 'extrem':1A,23B,41B,96C,190C 'extreme-network':22B 'fix':176C 'get':65B 'github':198C 'github.com':200C 'github.com/toanln-cov)':199C 'hash':14A,73B,142C,156C 'includ':135C 'inform':134C 'infrastructur':25B 'interfac':57B,94C,126C 'issu':174C 'json':54B,90C 'json-rpc':53B,89C 'lead':81B,166C 'like':193C 'line':125C 'local':70B,144C 'low':34B,105C 'low-privileg':33B,104C 'lê':197C 'may':80B 'miss':85C 'network':2A,24B,27B,42B,97C,191C 'network-switch':26B 'offlin':78B,160C 'password':13A,72B,141C,155C,164C 'patch1':181C,184C,188C 'privileg':35B,106C 'psirt':212C 'read':5A,37B,108C 'read-on':4A,36B,107C 'respons':203C 'restrict':118C 'result':129C 'role':60B,121C 'rpc':55B,91C 'run':47B 'sensit':133C 'servic':93C 'show':49B,114C 'success':127C 'switch':28B,30B,43B,98C,178C 'switch-engin':29B 'team':213C 'thank':195C 'toàn':196C 'user':7A,110C 'vulner':206C 'weak':163C 'web':56B,92C 'work':209C 'would':192C","nicknames":[],"mitigations":[],"who_affected":"Any network that runs Extreme Networks Switch Engine (EXOS) with the JSON-RPC web services interface available to authenticated read-only accounts. Configuration, enable and debug commands are not affected, so the risk centres on the read-only role. Teams that run no EXOS switches can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["exos","extremenetworks","high","infrastructure","networkswitches","switchengine"],"campaign_type":null,"search_a":"'-105440':17A,20A '-2026':16A,19A 'config':11A 'cve':15A,18A 'devic':10A 'dump':9A 'exo':3A 'extrem':1A 'hash':14A 'network':2A 'password':13A 'read':5A 'read-on':4A 'user':7A","search_b":"'access':84B 'account':39B,71B 'administr':83B 'attack':64B 'block':62B 'cli':48B 'command':50B 'configur':68B 'crack':77B 'devic':67B 'engin':31B,44B 'exo':21B,45B 'extrem':23B,41B 'extreme-network':22B 'get':65B 'hash':73B 'infrastructur':25B 'interfac':57B 'json':54B 'json-rpc':53B 'lead':81B 'local':70B 'low':34B 'low-privileg':33B 'may':80B 'network':24B,27B,42B 'network-switch':26B 'offlin':78B 'password':72B 'privileg':35B 'read':37B 'read-on':36B 'role':60B 'rpc':55B 'run':47B 'show':49B 'switch':28B,30B,43B 'switch-engin':29B 'web':56B","search_c":"'-11':182C,189C '-9':185C '/toanln-cov)':201C '32.7.4.15':187C '33.1.100.133':183C '33.7.1':180C 'access':169C 'account':145C 'administr':168C 'affect':153C 'allow':101C 'attack':159C 'authent':103C 'author':86C 'cli':113C 'command':115C,124C,150C 'configur':138C,146C 'coordin':215C 'could':165C 'debug':149C 'devic':137C,172C 'disclos':154C,204C 'disclosur':131C,216C 'enabl':147C 'engin':99C,179C 'execut':112C 'exo':100C 'exploit':128C 'extrem':96C,190C 'fix':176C 'github':198C 'github.com':200C 'github.com/toanln-cov)':199C 'hash':142C,156C 'includ':135C 'inform':134C 'interfac':94C,126C 'issu':174C 'json':90C 'json-rpc':89C 'lead':166C 'like':193C 'line':125C 'local':144C 'low':105C 'low-privileg':104C 'lê':197C 'miss':85C 'network':97C,191C 'offlin':160C 'password':141C,155C,164C 'patch1':181C,184C,188C 'privileg':106C 'psirt':212C 'read':108C 'read-on':107C 'respons':203C 'restrict':118C 'result':129C 'role':121C 'rpc':91C 'sensit':133C 'servic':93C 'show':114C 'success':127C 'switch':98C,178C 'team':213C 'thank':195C 'toàn':196C 'user':110C 'vulner':206C 'weak':163C 'web':92C 'work':209C 'would':192C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T16:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"1c053176-eef3-4d6a-ae0b-24728c86587b","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105440","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105440","severity":null,"published_at":"2026-11-11T16:17:24+00:00","modified_at":"2026-11-11T16:17:24+00:00","first_seen_at":"2026-11-11T16:28:06+00:00","fetched_at":"2026-11-11T16:28:06+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}