CVE-2026-8170 Overview
CVE-2026-8170 affects the mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment. These utilities fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker holding a low-privilege command-line interface (CLI) account can create a symbolic link that references a privileged filesystem location. Invoking the affected utilities against that link allows the attacker to read, modify, or replace security-critical files outside their authorized scope. Under certain conditions, exploitation enables escalation to root-level access and persistent modification of the device software stack. The vulnerability is exploitable remotely by an authenticated low-privilege user, or locally through the serial console.
Critical Impact
Low-privilege authenticated attackers can escalate to root and persistently modify the ExtremeXOS software stack through symbolic link manipulation ([CWE-59]).
Affected Products
- Extreme Networks ExtremeXOS (EXOS)
- EXOS shell environment mv, cp, and rm utilities
- Devices exposing CLI access to low-privilege accounts or serial console
Discovery Timeline
- Disclosure credit - Hadrien Barral (Université Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) reported the findings to Extreme Networks
- 2026-07-20 - CVE-2026-8170 published to the National Vulnerability Database (NVD)
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-8170
Vulnerability Analysis
CVE-2026-8170 is a symbolic link following vulnerability classified under [CWE-59] (Improper Link Resolution Before File Access). The EXOS shell exposes a restricted set of file utilities to CLI users, including mv, cp, and rm. These utilities are intended to operate only within directories accessible to the invoking user. However, the utilities do not canonicalize their target paths before performing operations, and they follow symbolic links across privilege boundaries. As a result, filesystem operations executed by these utilities can act on files owned by higher-privileged accounts, including the root user. The impact extends beyond simple file access. An attacker can replace or delete files that are loaded, executed, or trusted by privileged system components, converting a file operation into arbitrary privileged code execution or persistent firmware-level tampering.
Root Cause
The root cause is missing path canonicalization and unsafe symbolic link handling in the wrapper logic that exposes mv, cp, and rm to shell users. The utilities resolve symbolic links at operation time rather than validating that the resolved target remains within the caller's authorized scope. This TOCTOU-adjacent design flaw allows a symlink placed in a user-writable directory to redirect file operations to arbitrary system paths.
Attack Vector
Exploitation requires an authenticated account with low-privilege CLI access. The attacker creates a symbolic link within a directory they control that points to a security-critical file, such as configuration, credential storage, or a binary loaded by privileged services. The attacker then invokes mv, cp, or rm against the link. Because the utility follows the link without boundary checks, the operation is applied to the privileged target. Repeated use enables staging of attacker-controlled files at trusted paths, leading to root-level compromise and persistence across reboots. Remote exploitation is possible over any management interface that grants shell access; local exploitation is possible through the serial console.
No verified public proof-of-concept code is available at the time of publication. Refer to the Extreme Networks Security Policies for advisory details.
Detection Methods for CVE-2026-8170
Indicators of Compromise
- Unexpected symbolic links in user-writable directories on EXOS devices that resolve to system paths under /etc, /usr, or firmware image locations
- CLI command history showing mv, cp, or rm operations against paths outside the invoking user's authorized scope
- Unexplained modifications to system binaries, startup scripts, or configuration files following low-privilege user sessions
- Integrity check failures on EXOS system images or configuration bundles
Detection Strategies
- Collect EXOS command auditing logs and alert on mv, cp, or rm invocations executed by non-administrative accounts
- Baseline filesystem contents of managed switches and compare hashes of critical files across reboots and configuration changes
- Correlate serial console logins with subsequent filesystem modification events
Monitoring Recommendations
- Forward EXOS syslog and command accounting records to a centralized SIEM for retention and correlation
- Monitor authentication events on management planes, especially low-privilege account logins from unusual source addresses
- Track configuration and firmware version drift across the fleet using network management tooling
How to Mitigate CVE-2026-8170
Immediate Actions Required
- Restrict CLI and serial console access to trusted administrators, removing low-privilege shell accounts where possible
- Apply the vendor-supplied patch as soon as it is available from Extreme Networks for the affected EXOS release train
- Rotate credentials for any accounts that had CLI access prior to remediation
- Audit devices for unexpected symbolic links and file modifications in user-accessible directories
Patch Information
Extreme Networks tracks fixes through its product security process. Consult the Extreme Networks Security Policies page and the vendor's PSIRT advisories for fixed EXOS versions and upgrade guidance. Apply the patched release across all affected switches and validate configuration integrity after upgrade.
Workarounds
- Disable interactive shell access for non-administrative accounts on EXOS devices
- Enforce strict role-based access control (RBAC) and remove unused local accounts
- Place management interfaces on an isolated out-of-band network reachable only from hardened jump hosts
- Physically secure serial console ports and require multi-factor authentication for any bastion providing console access
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
