{"id":"EM-20261112-ART5","url":"https://cyber.eventmonitor.net/incident/EM-20261112-ART5/json-rpc-vulnerability-cve-2026-105440/","type":"cve","title":"JSON-RPC Vulnerability (CVE-2026-105440)","subtitle":"CVE-2026-105440","subject":"CVE-2026-105440","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-12T14:42:07.000Z","firstSignal":"2026-11-11T16:17:24.817Z","lastSignal":"2026-11-12T14:42:07.000Z","updated":"2026-11-12T15:50:47.989Z","revision":1,"life":[{"status":"Born","at":"2026-11-12T14:42:07.000Z","why":"second independent source: C31 Vulners (new public exploits)"},{"status":"Developing","at":"2026-11-12T14:42:07.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-11T16:17:24.817Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-12T14:42:07.000Z","what":"Born: second source, C31 Vulners (new public exploits). Page EM-20261112-ART5 created."}],"stages":[{"name":"Disclosed","at":"2026-11-11T16:17:24.817Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-11T16:17:24.817Z","detail":"CVSS 8.3 · EPSS 0.4%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-11T16:17:24.817Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-105440 (CVSS 8.3)","text":"Missing authorization in the JSON-RPC web services interface\nof Extreme Networks Switch Engine (EXOS) allows an authenticated,\nlow-privileged (read-only) user to execute CLI show commands that are\nrestricted to that role through the command line interface. Successful\nexploitation results in disclosure of sensitive information, including the\ndevice configuration and the password hashes of local accounts. Configuration,\nenable, and debug commands are not affected. Disclosed password hashes can be\nattacked offline, and a weak password could lead to administrative access to\nthe device. This…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105440"},{"at":"2026-11-12T14:42:07.000Z","source":"C31","sourceName":"Vulners (new public exploits)","role":"Research & News","severity":3,"title":"Public exploit: Exploit for CVE-2026-105440","text":"# Broken Access Control via JSON-RPC API — Privilege Escalation to Admin Credentials\n\n**Extreme Networks Switch Engine (EXOS) — A Read-Only User Bypasses the CLI ACL via the JSON-RPC API to Disclose the Full Configuration and Crack the Admin Password…","url":"https://github.com/toanln-cov/CVE-2026-105440"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-11T16:17:24.817","score":8.3,"severity":"HIGH","desc":"Missing authorization in the JSON-RPC web services interface\nof Extreme Networks Switch Engine (EXOS) allows an authenticated,\nlow-privileged (read-only) user to execute CLI show commands that are\nrestricted to that role through the command line interface. Successful\nexploitation results in…","product":"","seen":1794424417224},"kev":null,"epss":{"epss":0.00362,"pct":0.30405,"at":1794498647989},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}