Summary
A pre-authentication remote code execution exists in React Server Components, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The code unsafely deserializes payloads from HTTP requests to Server Function endpoints
Products Potentially Affected
|
OS/Product
|
Exposure
|
|
ExtremeAnalytics for Site Engine
|
No
|
|
ExtremeCloud IQ (XIQ)
|
No
|
|
ExtremeCloud IQ - Site Engine (XIQ-SE)
|
No
|
|
ExtremeCloud IQ Essentials
|
No
|
|
ExtremeCloud Orchestrator (XCO/EFA)
|
No
|
|
ExtremeLocation
|
No
|
|
Extreme AirDefense
|
No
|
|
ExtremeCloud Universal ZTNA
|
No
|
|
ExtremeControl for Site Engine
|
No
|
|
ExtremeCloud SD-WAN Appliance
|
No
|
|
Fabric Engine (VOSS)
|
No
|
|
Switch Engine (EXOS)
|
No
|
|
ExtremeCloud IQ Controller (IQC/XCC)
|
No
|
|
IQ Engine (HiveOS)
|
No
|
Repair Recommendation
None.
Please see the full Security Advisory article here for more details and future updates.
