CVE-2025-8679Critical· 9.8▾ MidnightIn ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access. Client360 logs may display the client MAC as the username despite no MAC-authentication being enabled.
extremeguest_essentials < 25.5.0Upgrade past the affected range:
extremeguest_essentials 25.5.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-12547Low· 3.7A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1
CVE-2025-66204High· 8.1WBCE CMS is a content management system
CVE-2025-11192High· 8.6A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered
CVE-2023-46273High· 8.8Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_send.
CVE-2026-15586Medium· 5.3OTP Brute-Force Account Takeover in Idvlabs Software's Ontime
CVE-2026-107145Medium· 6.3Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator