PT-2026-61670 · Extreme Networks · Extremexos

CVE-2026-8170 · Published 2026-07-20 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ExtremeXOS (EXOS) (affected versions not specified)

Description The mv, cp, and rm file utilities within the shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. This allows an attacker with low-privilege CLI access to create a symbolic link referencing a privileged filesystem location and use these utilities to read, modify, or replace security-critical files. This can lead to root-level access escalation and persistent modification of the device software stack. Exploitation can occur remotely via a low-privilege account or locally through the serial console.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-8170

Affected Products

Extremexos

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-8170 · Security Note
• https://twitter.com/VulmonFeeds/status/2079355694646493471 · Twitter Post
• https://extremenetworks.com/support/policies/product-security · Note
• https://twitter.com/MalwareObserver/status/2079279378408616136 · Twitter Post