CVE-2026-8169: Switch Engine (EXOS) 0 to before 31.7.4, 32.0.0 to before 32.7.4.15, 33.0.0 to before 33.1.100, 33.2.0 to before 33.7.1

Affected technology

Switch Engine (EXOS) · 0 to before 31.7.4, 32.0.0 to before 32.7.4.15, 33.0.0 to before 33.1.100, 33.2.0 to before 33.7.1
Extreme Networks

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says the challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode without authorization. Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.