CVE-2025-11192 PUBLISHED

Fabric Engine (VOSS) AutoSense Authentication Bypass

Assigner: ExtremeNetworks
Reserved: 30.09.2025 Published: 07.10.2025 Updated: 07.10.2025

A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure fabric connectivity without validating ISIS authentication settings. The SD-WAN AutoSense implementation may be exploited by malicious actors by allowing unauthorized access to network fabric and configuration data.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N
CVSS Score: 8.4

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Physical	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	High	Integrity	High
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	Extreme Networks
Product	Fabric Engine (VOSS)
Versions	Default: unaffected affected from 9.2 to <9.2 (incl.)

Solutions

Fixed in 9.3 or later.

References

https://extreme-networks.my.site.com/ExtrArticleDetail?an=000130291

Problem Types

CWE-287 Improper Authentication CWE

Impacts

CAPEC-115 Authentication Bypass