CVE-2024-27453

In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machine Interface (MMI).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.6 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
mitreCNA
---
---
CISA-ADPADP
8.6 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 44%
VendorProductVersion
extremenetworksextremexos
𝑥
< 22.7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://extreme-networks.my.site.com/ExtrArticleDetail?an=000118266
https://www.exsiliumsecurity.com/CVE-2024-27453.html
https://extreme-networks.my.site.com/ExtrArticleDetail?an=000118266
https://www.exsiliumsecurity.com/CVE-2024-27453.html