Executive brief
ExtremeXOS (EXOS) is the operating system used in Extreme Networks enterprise switches to manage network traffic and security. A vulnerability in the system's debug mode allows an attacker with low-level access to bypass security checks and gain full administrative control. This could lead to unauthorized monitoring of network traffic, permanent modification of the device software, or a complete takeover of the network infrastructure.
Technical details
ExtremeXOS (EXOS) contains a vulnerability (CWE-338) where the challenge-response mechanism for accessing privileged debug-mode functions uses an insufficiently random source for challenge generation. This predictability allows an attacker to calculate the expected response and bypass authentication for the debug interface. Exploitation requires either a valid low-privilege account for remote network access or physical access to the serial console. Successful exploitation can lead to root-level privilege escalation and the ability to persistently modify the device's software stack. The issue is addressed in versions 31.7.4, 32.7.4.15, 33.1.100, and 33.7.1.
Affected products
- Extreme Networks Switch Engine (EXOS) < 31.7.4, 32.0.0 < 32.7.4.15, 33.0.0 < 33.1.100, 33.2.0 < 33.7.1
Timeline
- 2026-07-20: disclosed
- 2026-07-20: advisory