CVE-2023-46273: Extreme Networks IQ Engine Buffer Overflow

CVE-2023-46273 Overview

CVE-2023-46273 is a stack-based buffer overflow [CWE-121] in the Bonjour Gateway component of Extreme Networks IQ Engine. The flaw resides in the ah_bgd module and is reachable through the ah_event_send function. Authenticated attackers on the network can trigger the overflow to compromise affected devices. The vulnerability affects IQ Engine versions before 10.6r1a, and versions from 10.6r4 through builds preceding 10.6r5.

Critical Impact
Successful exploitation allows an attacker with low privileges to corrupt memory on the gateway, enabling potential arbitrary code execution, loss of confidentiality, and disruption of wireless network services.

Affected Products

Extreme Networks IQ Engine versions before 10.6r1a
Extreme Networks IQ Engine versions 10.6r4 through builds before 10.6r5
Bonjour Gateway component (ah_bgd) within IQ Engine

Discovery Timeline

2026-09-14 - CVE-2023-46273 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2023-46273

Vulnerability Analysis

The Bonjour Gateway (ah_bgd) in Extreme Networks IQ Engine handles multicast DNS (mDNS) and service discovery traffic on wireless networks. The component contains a buffer overflow that an attacker can reach through the ah_event_send code path. When crafted event data flows into a fixed-size buffer, the boundary check fails and adjacent stack memory is overwritten.

An attacker with network access and low privileges can send malformed input to overwrite return addresses or control structures. This provides a path to arbitrary code execution in the context of the Bonjour Gateway process. Because Bonjour Gateway runs on infrastructure devices, compromise can pivot to broader network access.

The issue is classified under [CWE-121: Stack-based Buffer Overflow]. The EPSS probability sits at 0.312%, reflecting no public exploit at the time of publication.

Root Cause

The root cause is missing or insufficient bounds validation on data passed to ah_event_send inside the ah_bgd handler. The function copies event payload data into a stack-allocated buffer without verifying the source length against the destination size, producing classic stack corruption.

Attack Vector

The attack vector is network-based and requires low privileges but no user interaction. An authenticated attacker crafts Bonjour Gateway event traffic that triggers the vulnerable code path in ah_event_send. See the Extreme Networks Article Summary for vendor-specific technical guidance.

No verified proof-of-concept code is publicly available. Refer to the vendor advisory for technical details on the vulnerable code path.

Detection Methods for CVE-2023-46273

Indicators of Compromise

Unexpected crashes or restarts of the Bonjour Gateway process (ah_bgd) on IQ Engine devices
Anomalous mDNS or Bonjour event traffic directed at management interfaces of Extreme Networks access points
Unauthorized configuration changes or new administrative sessions following abnormal gateway traffic

Detection Strategies

Inspect syslog output from IQ Engine devices for repeated ah_bgd faults, segmentation events, or watchdog restarts
Monitor for malformed Bonjour service advertisements or oversized mDNS payloads targeting wireless controllers
Correlate authentication events with abnormal gateway behavior to identify low-privilege accounts abused for exploitation

Monitoring Recommendations

Forward IQ Engine device logs to a centralized SIEM for baseline analysis of Bonjour Gateway service health
Enable network flow monitoring on VLANs that carry mDNS traffic to identify traffic spikes toward gateway components
Alert on new or unexpected privileged sessions on affected access points following gateway anomalies

How to Mitigate CVE-2023-46273

Immediate Actions Required

Upgrade Extreme Networks IQ Engine to version 10.6r1a or later, and for the 10.6r4 branch upgrade to 10.6r5 or later
Inventory all IQ Engine devices to identify systems running vulnerable versions
Restrict management-plane access to Bonjour Gateway functions using network segmentation and ACLs

Patch Information

Extreme Networks addresses CVE-2023-46273 in IQ Engine 10.6r1a and 10.6r5. Consult the Extreme Networks Article Summary for the authoritative patch notice and upgrade guidance. Additional product information is available on the Extreme Networks Official Website.

Workarounds

Disable the Bonjour Gateway feature on affected IQ Engine devices where the service is not required
Limit accounts with network access to affected devices and enforce least-privilege administrative roles
Apply strict ACLs restricting mDNS and Bonjour traffic to trusted VLANs and management sources

bash

# Verify IQ Engine version and plan the upgrade path
show version
# Upgrade to a fixed release (10.6r1a or 10.6r5+)
save config running
upgrade image tftp://<server>/IQEngine-10.6r5.img
reboot