CVE-2026-105440: Switch Engine (EXOS) JSON-RPC Authorization Bypass Allows Read-Only Users to Disclose Sensitive Information
Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authenticated, low-privileged (read-only) user to execute CLI show commands that are restricted to that role through the command line interface. Successful exploitation results in disclosure of sensitive information, including the device configuration and the password hashes of local accounts. Configuration, enable, and debug commands are not affected. Disclosed password hashes can be attacked offline, and a weak password could lead to administrative access to the device. This issue is fixed in Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Extreme Networks Switch Engine (EXOS)to a version that resolves this vulnerability.Fixed in 33.7.1-patch1-11 - Upgrade
Upgrade
Extreme Networks Switch Engine (EXOS)to a version that resolves this vulnerability.Fixed in 33.1.100.133-patch1-9 - Upgrade
Upgrade
Extreme Networks Switch Engine (EXOS)to a version that resolves this vulnerability.Fixed in 32.7.4.15-patch1-11 - Operational
After upgrading, rotate local account passwords, especially administrative account passwords, because password hashes may have been disclosed.
Event History
Frequently Asked Questions
Which users and interfaces are required for exploitation?
An attacker needs an authenticated low-privileged account with read-only access and access to the JSON-RPC web services interface. The issue affects authorization enforcement in that interface, not the command-line interface itself.
What information can be exposed, and can the flaw directly alter switch configuration?
A read-only user can run otherwise restricted CLI show commands through JSON-RPC, potentially disclosing the device configuration and local-account password hashes. Configuration, enable, and debug commands are not affected, so the described issue does not directly permit configuration changes.
What is the escalation risk after disclosure?
Disclosed local-account password hashes can be attacked offline. If a password is weak and recovered, this could lead to administrative access to the device.
Which fixed Switch Engine releases are identified?
The issue is fixed in Switch Engine 33.7.1-patch1-11, 33.1.100.133-patch1-9, and 32.7.4.15-patch1-11.