Stack-based buffer overflow in Extreme Networks products - CVE-2023-46272

Vulnerability identifier: #VU84983

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-46272

CWE-ID: CWE-121

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the ah_auth service. A remote unauthenticated attacker on the local network can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

AP410C-1
AP5050U
AP5050D
AP5010
AP4000-1
AP4000
AP3000X
AP3000
AP650X
AP650
AP630
AP510C/CX
AP460S12C
AP460S6C
AP460C
AP30
AP410C
AP305C-1
AP305C/CX
AP302W
AP1130
AP550
AP250
AP245X
AP230
AP150W
AP130
AP122X
AP122
IQ Engine

Install updates from vendor's website.

IQ Engine - addressed in versions 10.6r1a, 10.6r5

• https://www.zerodayinitiative.com/advisories/ZDI-23-1765/
• https://extreme-networks.my.site.com/ExtrArticleDetail?an=000115355&q=CVE-2023-46272

• Multiple vulnerabilities in Extreme Networks IQ Engine