CVE-2025-8679
criticalIn ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure.
Vendor / product: Extremenetworks — extremeguest essentials
In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access. Client360 logs may display the client MAC as the username despite no MAC-authentication being enabled.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2025-10-01 18:15
Modified: 2026-10-12 15:10
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
extremenetworks / extremeguest_essentials <25.5.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://extreme-networks.my.site.com/ExtrArticleDetail?an=000130289
References
- https://extreme-networks.my.site.com/ExtrArticleDetail?an=000130289 1c053176-eef3-4d6a-ae0b-24728c86587b
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗