CVE-2023-46271 Memory corruption in n/a
A buffer overflow in the Extreme Networks IQ Engine web UI service allows remote attackers to execute arbitrary code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-46271?
CVE-2023-46271 is a critical memory corruption vulnerability in n/a, published on 19 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has a buffer overflow. This issue arises from the ah_webui service, which listens on TCP port 3009 by default.
Weakness: CWE-120
Which versions are affected by CVE-2023-46271?
How do I fix CVE-2023-46271?
No fix has been published for CVE-2023-46271 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-46271 being exploited?
There is no known exploitation of CVE-2023-46271 in the wild and no public exploit code.
Sources
Also known as GHSA-222j-rx46-g89g.