CVE-2024-27453

EUVD-2024-24653
In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machine Interface (MMI).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.6 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CISA-ADPADP
8.6 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 52%
Affected Products (NVD)
VendorProductVersion
extremenetworksextremexos
𝑥
< 22.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://extreme-networks.my.site.com/ExtrArticleDetail?an=000118266
https://www.exsiliumsecurity.com/CVE-2024-27453.html
https://extreme-networks.my.site.com/ExtrArticleDetail?an=000118266
https://www.exsiliumsecurity.com/CVE-2024-27453.html