PT-2023-28705 · Extreme Networks · Extreme Networks Switch Engine

David Yesland · CVE-2023-43120 · Published 2023-10-16 · Updated 2024-09-17

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Extreme Networks Switch Engine (EXOS) versions prior to 22.7 Extreme Networks Switch Engine (EXOS) versions prior to 31.7.1 Extreme Networks Switch Engine (EXOS) versions prior to 32.5.1.5

Description An issue in Extreme Networks Switch Engine (EXOS) allows attackers to gain escalated privileges via crafted HTTP requests.

Recommendations For versions prior to 22.7, update to version 22.7 or later. For versions prior to 31.7.1, update to version 31.7.1 or later. For versions prior to 32.5.1.5, update to version 32.5.1.5 or later.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-43120

Affected Products

Extreme Networks Switch Engine

References · 8

• https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114377 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43120 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43120 · Security Note
• https://t.me/cibsecurity/72329 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1714016601459040453 · Twitter Post
• https://twitter.com/AndreBConte/status/1733560184230801830 · Twitter Post
• https://t.me/cvenotify/94964 · Telegram Post
• https://twitter.com/CVEnew/status/1713996724929261768 · Twitter Post