Extremenetworks
11 CVEs across 43 Extremenetworks products. Browse Extremenetworks vulnerabilities, severities, and proof-of-concept exploits.
Extremenetworks products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0689 | Medium | 4.9 | 2026-03-02 | In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retr… |
CVE-2025-11192 | High | 8.6 | 2025-10-07 | A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure… |
CVE-2025-8679 | Critical | 9.8 | 2025-10-01 | In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials… |
CVE-2025-6235 | Medium | 6.1 | 2025-07-21 | In ExtremeControl before 25.5.12, a cross-site scripting (XSS) vulnerability was discovered in a login interface of the affected application. The issue stems f… |
CVE-2025-6083 | Medium | 4.3 | 2025-06-13 | In ExtremeCloud Universal ZTNA, a syntax error in the 'searchKeyword' condition caused queries to bypass the owner_id filter. This issue may allow users to sea… |
CVE-2024-38292 | Critical | 9.8 | 2025-02-27 | In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible, which may lead to privilege escalation. |
CVE-2024-38291 | High | 8.8 | 2025-02-27 | In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation. |
CVE-2024-38290 | Medium | 5.3 | 2025-02-27 | In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met. |
CVE-2020-18305 | High | 8.0 | 2024-05-14 | Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers… |
CVE-2024-27453 | High | 8.6 | 2024-05-03 | In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machin… |
CVE-2023-43121 | High | 7.5 | 2023-10-16 | A Directory Traversal vulnerability discovered in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7, and before 31.7.2 a… |
CVE-2023-43119 | Critical | 9.8 | 2023-10-16 | An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated priv… |
CVE-2023-43118 | High | 8.8 | 2023-10-16 | Cross Site Request Forgery (CSRF) vulnerability in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 al… |
CVE-2023-43120 | High | 8.8 | 2023-10-16 | An issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, before 22.7 and before 31.7.1 allows attackers to gain escalated privileges via c… |
CVE-2023-35803 | Critical | 9.8 | 2023-10-04 | IQ Engine before 10.6r2 on Extreme Network AP devices has a Buffer Overflow. |
CVE-2023-35802 | Critical | 9.8 | 2023-07-15 | IQ Engine before 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the implementation of the CAPWAP protocol that may be exploited to obtain elevat… |
CVE-2020-16152 | Critical | 9.8 | 2021-11-14 | The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP cod… |
CVE-2020-13819 | Medium | 6.1 | 2020-08-05 | Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request. |
CVE-2020-16847 | Medium | 6.1 | 2020-08-04 | Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in a GET request, aka CFD-4887. |
CVE-2020-13820 | Medium | 6.1 | 2020-08-03 | Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request. |
CVE-2018-5797 | High | 7.5 | 2018-02-05 | An issue was discovered in Extreme Networks ExtremeWireless WiNG 5.x before 5.8.6.9 and 5.9.x before 5.9.1.3. There is an Smint_encrypt Hardcoded AES Key that… |
CVE-2018-5787 | High | 7.5 | 2018-02-05 | An issue was discovered in Extreme Networks ExtremeWireless WiNG 5.x before 5.8.6.9 and 5.9.x before 5.9.1.3. There is a Remote, Unauthenticated Stack Overflow… |
CVE-2017-14332 | High | 8.1 | 2017-10-23 | Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to hijack sessions by determining SessionID values. |
CVE-2017-14331 | Medium | 6.7 | 2017-10-23 | Extreme EXOS 16.x, 21.x, and 22.x allows administrators to bypass the "exsh restricted shell" protection mechanism and obtain an interactive shell. |
CVE-2017-14330 | Medium | 6.7 | 2017-10-23 | Extreme EXOS 16.x, 21.x, and 22.x allows administrators to obtain a root shell via vectors involving a privileged process. |
CVE-2017-14329 | Medium | 6.7 | 2017-10-23 | Extreme EXOS 16.x, 21.x, and 22.x allows administrators to obtain a root shell via vectors involving an exsh debug shell. |
CVE-2017-14328 | High | 7.5 | 2017-10-23 | Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to trigger a buffer overflow leading to a reboot. |
CVE-2017-14327 | Medium | 4.4 | 2017-10-23 | Extreme EXOS 16.x, 21.x, and 22.x allows administrators to read arbitrary files. |
CVE-2013-7309 | | 2014-01-23 | The OSPF implementation in Extreme Networks EXOS does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets… | |
CVE-2005-1670 | | 2005-05-19 | Unknown vulnerability in Extreme BlackDiamond 10808 and 8800 switches running ExtremeWare XOS 11.1 before 11.1.3.3, 11.0 before 11.0.2.4, and 10.x allows remot… |