CVE-2023-43118

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-16 · updated 2026-06-17
Weakness: CWE-352

Description

Cross Site Request Forgery (CSRF) vulnerability in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 allows attackers to run arbitrary code and cause other unspecified impacts via /jsonrpc API.

Affected products

extremenetworks Exos: from 31.7.0 before 31.7.2; from 32.0 before 32.5.1.5 — fixed in 31.7.2, 32.5.1.5

How to fix

Upgrade to a fixed version: extremenetworks Exos 31.7.2, 32.5.1.5. Check the vendor advisory for mitigations.

References

https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114379
https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114379

Get alerted when CVE-2023-43118 or the next vulnerability affects your stack