{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/toanln-cov/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["toanln-cov"],"_cs_cpes":[],"_cs_cves":[{"cvss":6.5,"id":"CVE-2026-105440"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Switch Engine","ExtremeXOS"],"_cs_severities":["high"],"_cs_tags":["cve-2026-105440","broken-access-control","privilege-escalation"],"_cs_type":"threat","_cs_vendors":["Extreme Networks"],"content_html":"\u003cp\u003eExtreme Networks Switch Engine (EXOS) contains a broken access control vulnerability (CVE-2026-105440) where the JSON-RPC API endpoint 'POST /jsonrpc/?show' fails to re-validate a caller's privilege level. While the CLI properly restricts read-only users, the API accepts 'method: \u0026quot;cli\u0026quot;' requests for privileged commands, allowing authenticated users to retrieve system configuration and password hashes.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates with a read-only account via the REST API to obtain a JWT.\u003c/li\u003e\n\u003cli\u003eAttacker invokes 'POST /jsonrpc/?show' with 'method: \u0026quot;cli\u0026quot;' to execute restricted commands like 'show configuration' and 'show accounts'.\u003c/li\u003e\n\u003cli\u003eThe API returns sensitive data, including SHA-256 crypt password hashes, which the attacker cracks offline to gain administrative access.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eExploitation results in the disclosure of device configuration, routing policies, and local account password hashes, enabling full administrative compromise through offline brute-force attacks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eRefer to the official vendor advisory for patching guidance and administrative restrictions.\u003c/p\u003e\n","date_modified":"2026-11-12T16:44:12Z","date_published":"2026-11-12T16:44:12Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-105440/","summary":"An authorization bypass vulnerability in the Extreme Networks Switch Engine (EXOS) JSON-RPC API allows low-privileged users to execute unauthorized CLI commands to disclose system configuration and account password hashes.","title":"Extreme Networks Switch Engine: Broken Access Control in JSON-RPC API (CVE-2026-105440)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-105440/"}],"language":"en","title":"CraftedSignal Threat Feed - Toanln-Cov","version":"https://jsonfeed.org/version/1.1"}