PT-2023-6509 · Extreme Networks · Extreme Networks Switch Engine
David Yesland
·
Publicado
2023-10-16
·
Atualizado
2024-09-17
·
CVE-2023-43119
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Extreme Networks Switch Engine (EXOS) versions prior to 22.7
Extreme Networks Switch Engine (EXOS) versions prior to 31.7.2
Extreme Networks Switch Engine (EXOS) versions prior to 32.5.1.5
Description
The issue is related to an Access Control problem in the Extreme Networks Switch Engine (EXOS) software, which can be exploited by attackers to gain escalated privileges. This can be achieved by using crafted telnet commands via the Redis server.
Recommendations
For versions prior to 22.7, update to version 22.7 or later to resolve the issue.
For versions prior to 31.7.2, update to version 31.7.2 or later to resolve the issue.
For versions prior to 32.5.1.5, update to version 32.5.1.5 or later to resolve the issue.
As a temporary workaround, consider restricting access to the telnet service and Redis server to minimize the risk of exploitation.
Correção
Improper Access Control
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Extreme Networks Switch Engine