CVE-2023-40457: Extreme networks extremeware xos vulnerability
The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who is not on a directly connected network) to cause a denial of service (BGP session reset) because of BGP attribute error mishandling (for attribute 21 and 25). NOTE: the vendor disputes this because it is "evaluating support for RFC 7606 as a future feature" and believes that "customers that have chosen to not require or implement RFC 7606 have done so willingly and with knowledge of what is needed to defend against these types of attacks."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40457?
CVE-2023-40457 has been classified as a high severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2023-40457?
To mitigate CVE-2023-40457, it is recommended to upgrade to an unaffected version of ExtremeXOS as specified by the vendor.
What type of attack does CVE-2023-40457 facilitate?
CVE-2023-40457 allows an attacker to reset BGP sessions remotely, leading to a denial of service.
Which versions of ExtremeXOS are affected by CVE-2023-40457?
CVE-2023-40457 affects ExtremeXOS version 30.7.1.1 specifically, with implications for others as well.
Can CVE-2023-40457 be exploited from a remote network?
Yes, CVE-2023-40457 can be exploited by an attacker who is not on a directly connected network.