When paired with a log poisoning technique, where an attacker injects malicious PHP code into system logs via failed authentication attempts, the LFI vulnerability allows for arbitrary command execution. Critically, the PHP process on these devices runs with root privileges, ensuring that any exploited code grants the attacker full system control. This vulnerability has been publicly documented with functional exploit code, representing a significant risk to unpatched networking infrastructure.

Attack Chain

1. The attacker probes the administrative web interface of a target HiveOS or IQ Engine device, identifying the /action.php5 endpoint.
2. The attacker performs a failed authentication attempt with a username containing malicious PHP code, which is recorded in the system log file at /tmp/messages.
3. The attacker crafts a request to /action.php5, targeting the _page parameter.
4. The attacker injects a long path sequence (e.g., repeating slash characters) into the _page parameter to trigger string truncation in the outdated PHP engine, stripping the required '.Access.class.php5' suffix.
5. The server includes the poisoned log file (/tmp/messages) as if it were a valid PHP class file.
6. The PHP interpreter executes the injected PHP code contained within the log file.
7. The command executes with root privileges, granting the attacker complete control over the networking device.

Impact

Successful exploitation results in full root-level compromise of the affected network appliance. This allows an attacker to intercept network traffic, modify device configurations, pivot into the internal network, or permanently disrupt critical connectivity. The vulnerability carries a CVSS score of 10.0, indicating the highest level of risk to confidentiality, integrity, and availability.

Recommendation

1. Upgrade Extreme Networks HiveOS and IQ Engine to version 10.0r8a or later immediately to patch the LFI vulnerability.
2. If an immediate upgrade is not possible, disable the web-based management interface by executing the command 'no system web-server hive-UI enable' via the CLI.
3. Monitor network logs for unusual HTTP POST requests to /action.php5, specifically looking for abnormal strings in the _page parameter that resemble path traversal sequences or PHP code injection.
4. Implement strict access control lists (ACLs) to restrict access to the device management interfaces to authorized IP addresses only.