Extreme Networks Switch Engine (EXOS): Missing authorization in JSON-RPC interface

Summary

The JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) does not enforce the read-only restrictions that apply to the command line interface. An authenticated user with a read-only account who can reach the management interface can run show commands denied to that role. This can disclose the device configuration and password hashes of local accounts, which can be cracked offline; a weak password could lead to administrative access to the device.

Affected

• Switch Engine (EXOS) 33.7.0 before 33.7.1-patch1-11
• Switch Engine (EXOS) 33.1.0 before 33.1.100-patch1-9
• Switch Engine (EXOS) 32.0.0 before 32.7.4.15-patch1-11
• Vendor advisory also lists 34.1.1 as fixed; whether 34.x is affected is unknown.

Fixed in

• Switch Engine 33.7.1-patch1-11
• Switch Engine 33.1.100-patch1-9
• Switch Engine 32.7.4.15-patch1-11
• Current vendor recommendations list later builds (for example 32.7.4.15-Patch1-14 and 33.7.1.6-Patch1-32); check the platform-specific list before choosing a target.

Workaround

• Restrict access to the management interface to trusted networks and hosts.
• Disable the web services (JSON-RPC) interface where it is not required.
• Limit read-only accounts to users who need them.
• Enforce strong, unique passwords on all local accounts.

Exploitation

• Not known to be exploited according to OffSeq; evidence is described as thin.
• No public proof of concept or CISA KEV listing found at the time of research.
• Exploitation requires a valid read-only account and access to the management interface.

Our recommendation

• Check whether the web/JSON-RPC interface is enabled and reachable from user networks, the internet or VPNs.
• Audit read-only accounts and remove those not needed.
• Upgrade to a fixed release, verifying the exact build for your platform.
• After upgrading, rotate local account passwords, especially administrative accounts, even if no exposure is confirmed.
• Monitor authentication and access logs for unusual show-command activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  toanln-cov/CVE-2026-105440

Research sources

• CVE Record CVE-2026-105440 www.cve.org
• Extreme Networks Security Advisory SA-2026-233 extreme-networks.my.site.com
• Extreme Networks Community: SA-2026-233 advisory community.extremenetworks.com
• OffSeq Radar: CVE-2026-105440 radar.offseq.com
• Extreme Networks compatibility matrix (sw-release-extremexos-eos) www.extremenetworks.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:20.