Skip to content
Threat Feed
Subscribe
high threat exploited

Extreme Networks Switch Engine: Broken Access Control in JSON-RPC API (CVE-2026-105440)

An authorization bypass vulnerability in the Extreme Networks Switch Engine (EXOS) JSON-RPC API allows low-privileged users to execute unauthorized CLI commands to disclose system configuration and account password hashes.

CVE search metadata

CVE search record: CVE-2026-105440. Severity: medium. CVSS: 6.5. KEV: no. Product: Switch Engine, ExtremeXOS. Brief: Extreme Networks Switch Engine: Broken Access Control in JSON-RPC API (CVE-2026-105440). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-105440/

Triage facts

Revision 1
Applicability
Switch Engine, ExtremeXOS
Evidence
Confirmed activeHigh confidence
Severity
High
Sources
4 public sources
Freshness
Revision 1Nov 12, 16:44 UTC
Vulnerabilities
1 CVE
Source quality
C2Likely

Extreme Networks Switch Engine (EXOS) contains a broken access control vulnerability (CVE-2026-105440) where the JSON-RPC API endpoint 'POST /jsonrpc/?show' fails to re-validate a caller's privilege level. While the CLI properly restricts read-only users, the API accepts 'method: "cli"' requests for privileged commands, allowing authenticated users to retrieve system configuration and password hashes.

Attack Chain

  1. Attacker authenticates with a read-only account via the REST API to obtain a JWT.
  2. Attacker invokes 'POST /jsonrpc/?show' with 'method: "cli"' to execute restricted commands like 'show configuration' and 'show accounts'.
  3. The API returns sensitive data, including SHA-256 crypt password hashes, which the attacker cracks offline to gain administrative access.

Impact

Exploitation results in the disclosure of device configuration, routing policies, and local account password hashes, enabling full administrative compromise through offline brute-force attacks.

Recommendation

Refer to the official vendor advisory for patching guidance and administrative restrictions.

Threat Hunt

Identify HTTP POST requests to the '/jsonrpc/?show' endpoint where the request body contains 'method: "cli"' and parameters 'show configuration' or 'show accounts', correlated with a user account previously identified as 'read-only' or lacking administrative privileges.

T1068 high high confidence hunt now

Data: Web server access logs, API gateway logs, Network telemetry

Monitor for anomalous, high-frequency access to account management or configuration retrieval commands via API, specifically looking for users who successfully authenticate via '/auth/token' and subsequently trigger 'show accounts' or 'show configuration' commands.

T1552 high high confidence hunt now

Data: Web server access logs, Authentication logs