CVE-2025-8679: ExtremeGuest Essentials Captive Portal Unauthenticated Brute Force
In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access. Client360 logs may display the client MAC as the username despite no MAC-authentication being enabled.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8679?
CVE-2025-8679 is considered a medium severity vulnerability due to its potential for unauthorized access through brute-force login attempts.
How do I fix CVE-2025-8679?
To fix CVE-2025-8679, upgrade your ExtremeGuest Essentials software to version 25.5.0 or later.
What does CVE-2025-8679 affect?
CVE-2025-8679 affects Extreme Networks ExtremeGuest Essentials prior to version 25.5.0.
What is the risk of exploiting CVE-2025-8679?
Exploiting CVE-2025-8679 allows unauthorized devices to gain access to the network, potentially leading to data breaches.
Can CVE-2025-8679 be exploited remotely?
Yes, CVE-2025-8679 can be exploited remotely by conducting repeated manual login attempts on the captive portal.