Read the docs
TI-2023-21275 Aliases CVE-2023-40457GHSA-hwrr-qggh-2777

The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who…

Priority LOW 29CWE-209Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Information disclosure
Confidentiality · integrity · availability
—
Fix status
No fix listed

No CVSS vector from any source. Fix status from CNA. Impact type from CWE-209.

Summary

The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who is not on a directly connected network) to cause a denial of service (BGP session reset) because of BGP attribute error mishandling (for attribute 21 and 25). NOTE: the vendor disputes this because it is "evaluating support for RFC 7606 as a future feature" and believes that "customers that have chosen to not require or implement RFC 7606 have done so willingly and with knowledge of what is needed to defend against these types of attacks."

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00298 22nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:o:extremenetworks:extremeos:*:*:*:*:*:*:*:*——Extreme Networks
  • cpe:2.3:o:extremenetworks:extremeos:*:*:*:*:*:*:*:* Versions — — ·Extreme Networks

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-40457
  2. 2026-10-03 Alias added: GHSA-hwrr-qggh-2777

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences