PT-2025-40280

CVE-2025-8679

·

Published

2025-10-01

·

Updated

2026-10-12

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ExtremeGuest Essentials versions prior to 25.5.0
Description The captive-portal feature may allow unauthorized access through manual brute-force attempts. Specific ExtremeGuest Essentials captive-portal SSID configurations could allow an unauthenticated device to be incorrectly marked as authenticated, granting network access. Client360 logs might incorrectly display the client MAC address as the username, even when MAC authentication is not enabled.
Recommendations Update to version 25.5.0 or later.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-307: Improper Restriction of Excessive Authentication Attempts
Related identifiers
CVE-2025-8679
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com