What is CVE-2023-43118?

CVE-2023-43118 is a high-severity vulnerability in Extremenetworks Exos, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2023-10-16.

How severe is CVE-2023-43118?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2023-43118 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

CSRF in Extremenetworks Exos

CVE-2023-43118

Cross Site Request Forgery (CSRF) vulnerability in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 allows attackers to run arbitrary code and cause other unspecified impacts via /jsonrpc API.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.003 (19.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Extremenetworks Exos
N/a — versions n/a

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

Public proof-of-concept exploits

RhinoSecurityLabs/CVEs

References

cve@mitre.org (Vendor Advisory)

Frequently asked questions

What is CVE-2023-43118?: CVE-2023-43118 is a high-severity vulnerability in Extremenetworks Exos, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2023-10-16.
How severe is CVE-2023-43118?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2023-43118 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.