---
id: "CVE-2026-105440"
page: "https://infrastack.ai/live/CVE-2026-105440"
kind: "vulnerability"
aliases: ["CVE-2026-105440"]
title: "Extreme Networks EXOS: read-only users can dump device config and password hashes"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["exos", "extreme-networks", "infrastructure", "network-switches", "switch-engine"]
not_affected_if: ["jsonrpc-disabled", "no-exos-switches", "no-read-only-accounts"]
published_at: "2026-11-11T16:17:24+00:00"
first_seen_at: "2026-11-11T16:28:06+00:00"
updated_at: "2026-11-11T16:29:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105440", "first_seen_at": "2026-11-11T16:28:06+00:00"}]
exploit_sources: []
---

# Extreme Networks EXOS: read-only users can dump device config and password hashes

Link for people: https://infrastack.ai/live/CVE-2026-105440 (this .md is for agents)

A low-privileged read-only account on Extreme Networks Switch Engine (EXOS) can run CLI show commands through the JSON-RPC web interface that the role should block. An attacker gets the device configuration and local account password hashes, which can be cracked offline and may lead to administrative access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look up the EXOS version running on the switch with `show version`
- Check whether the JSON-RPC web services interface is enabled on the switch and reachable by users with read-only roles
- Confirm whether the device is on a version listed as fixed in the sources

## Fix

- Switch Engine `33.7.1-patch1-11`
- Switch Engine `33.1.100.133-patch1-9`
- Switch Engine `32.7.4.15-patch1-11`

## Timeline

- 2026-11-11T16:28:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105440

## From the sources

Missing authorization in the JSON-RPC web services interface
of Extreme Networks Switch Engine (EXOS) allows an authenticated,
low-privileged (read-only) user to execute CLI show commands that are
restricted to that role through the command line interface. Successful
exploitation results in disclosure of sensitive information, including the
device configuration and the password hashes of local accounts. Configuration,
enable, and debug commands are not affected. Disclosed password hashes can be
attacked offline, and a weak password could lead to administrative access to
the device. This issue is fixed in Switch Engine 33.7.1-patch1-11,
33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.








Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_