Summary
A missing authorization vulnerability exists in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS). The command line interface prevents read-only users from executing certain show commands, but the JSON-RPC interface does not enforce the same restriction. An authenticated user with a read-only account who can reach the management interface can execute show commands denied to that role and retrieve sensitive information, including the device configuration and the password hashes of local accounts. Configuration, enable, and debug commands are not affected. Disclosed password hashes can be attacked offline, and a weak password could lead to administrative access to the device.
Customers should upgrade to a fixed release and rotate local account passwords, especially administrative accounts, after upgrading. Until an upgrade is possible, restrict management interface access to trusted networks, disable the web services interface where it is not required, and enforce strong, unique passwords on all local accounts.
Extreme Networks would like to thank Toàn Lê (GitHub: https://github.com/toanln-cov) for responsibly disclosing this vulnerability and for working with our PSIRT team through coordinated disclosure.
Products not listed in the Impact Details section have not been evaluated. Furthermore, products that have exceeded any software maintenance time periods are also not evaluated and will not be published. Please consult End of Sale and End of Service Life - Extreme Networks for the EOL notices related to the product under question.
Products Potentially Affected
None
Impact Details
|
OS/Product
|
Exposure
|
|
Switch Engine (EXOS)
|
Yes
|
Repair Recommendations
Switch Engine (EXOS):
- Fixed in 32.7.4 or later.
- Fixed in 33.7.1 or later.
- Fixed in 34.1.1 or later.
Please see the full Security Advisory here for more details and future updates.
