Executive brief
A vulnerability in Extreme Networks Switch Engine (EXOS) allows users with low-level access to bypass security restrictions and interact with sensitive system files. By using standard file commands like move or copy, an attacker can manipulate critical system data they should not be able to reach. This could lead to a complete takeover of the network switch, allowing unauthorized changes to the device software or permanent access for the attacker.
Technical details
A link-following vulnerability (CWE-59) exists in the mv, cp, and rm utilities within the ExtremeXOS (EXOS) shell environment. The affected utilities fail to properly canonicalize file paths or validate symbolic link targets, allowing them to operate on files outside of the user's intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic link pointing to a sensitive filesystem location and then use these utilities to manipulate security-critical files. This can result in unauthorized data access, modification of the software stack, and escalation to root-level privileges. The vulnerability is exploitable remotely via a low-privilege account or locally through the serial console.
Affected products
- Extreme Networks Switch Engine (EXOS) < 31.7.4, 32.0.0 < 32.7.4.15, 33.0.0 < 33.1.100, 33.2.0 < 33.7.1
Timeline
- 2026-07-20: advisory: Initial disclosure by Extreme Networks via NVD