Main Vulnerability Database SB2025100195

SB2025100195 - Improper authorization in Fabric Engine (VOSS)

Published: October 1, 2025

Security Bulletin ID SB2025100195

CSH Severity

Medium

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Adjecent network

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Authorization (CVE-ID: CVE-2025-11192)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass authorization process.

The vulnerability exists due to improper authorization checks. When SD-WAN AutoSense is enabled on a port, it may automatically configure fabric connectivity without validating ISIS authentication settings. The SD-WAN AutoSense implementation may be exploited by malicious actors by allowing unauthorized access to network fabric and configuration data.

Remediation

Install update from vendor's website.

References

https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2025-115-fabric-engine-voss-autosense-authentication-bypass/ba-p/120395