Read the docs
TI-2026-07193 Aliases CVE-2026-8170GHSA-x4hp-453h-hp48

ExtremeXOS Privilege Escalation via Symlink Following in File Utilities

Priority MEDIUM 40CWE-59Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic link that references a privileged filesystem location and then invoke the affected utilities to read, modify, or replace security-critical files outside of their authorized scope. Under certain conditions, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation is possible remotely by an attacker holding a low-privilege account, or locally via the serial console. Extreme would like to thank Hadrien Barral (Université Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00561 46th percentileScored 2026-11-07
Fix Fixed Switch Engine (EXOS) (Extreme Networks): 31.7.4, 32.7.4.15, 33.1.100 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Extreme NetworksSwitch Engine (EXOS)before 31.7.4; 32.0.0 to before 32.7.4.15; 33.0.0 to before 33.1.100; 33.2.0 to before 33.7.131.7.4, 32.7.4.15, 33.1.100, 33.7.1Patch availableCNA
  • Switch Engine (EXOS) VendorExtreme Networks Affected before 31.7.4; 32.0.0 to before 32.7.4.15; 33.0.0 to before 33.1.100; 33.2.0 to before 33.7.1 Fixed in 31.7.4, 32.7.4.15, 33.1.100, 33.7.1 Patch available CNA

Remediation

  • Fix · CNA Switch Engine (EXOS) (Extreme Networks) Fixed in 31.7.4, 32.7.4.15, 33.1.100, 33.7.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Extreme Networks Switch Engine (EXOS) 31.7.4, 32.7.4.15 and 2 more versions

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-07192 ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNGPriority MEDIUM 40
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8170
  2. 2026-10-03 Alias added: GHSA-x4hp-453h-hp48

References

Other 1

  • TI-2020-19042 Extreme Networks Aerohive HiveOS <=11.x 11.x Unauthenticated Remote Denial of Service CVSS 4.0HIGH 8.7
  • TI-2020-13364 Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue… CVSS 3.1HIGH 8.0
  • TI-2020-12704 The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive… CVSS 3.1CRITICAL 9.8
  • TI-2023-17891 IQ Engine before 10.6r2 on Extreme Network AP devices has a Buffer Overflow. CVSS 3.1CRITICAL 9.8
  • TI-2023-17890 IQ Engine before 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the… CVSS 3.1CRITICAL 9.8
  • TI-2024-25570 In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path… CVSS 3.1CRITICAL 9.8
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences