CVE-2023-40457

Not scored yetLast modified Jun 17, 2026

Description

The BGP daemon in Extreme Networks ExtremeXOS (aka EXOS) 30.7.1.1 allows an attacker (who is not on a directly connected network) to cause a denial of service (BGP session reset) because of BGP attribute error mishandling (for attribute 21 and 25). NOTE: the vendor disputes this because it is "evaluating support for RFC 7606 as a future feature" and believes that "customers that have chosen to not require or implement RFC 7606 have done so willingly and with knowledge of what is needed to defend against these types of attacks."

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-209

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-404587.5Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remote attackerCVE-2023-404597.5The ACEManager component of ALEOS 4.16 and earlier does not adequately perform input sanitization during authentication, which could potentiCVE-2023-40465.3In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilationCVE-2023-404605.4The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an aCVE-2023-404614.8The ACEManager component of ALEOS 4.16 and earlier allows an authenticated user with Administrator privileges to access a file upload CVE-2023-404627.5The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during authentication, which could potentially CVE-2023-404637.2When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hasCVE-2023-404646.8Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these itemCVE-2023-404655.5Several versions of ALEOS, including ALEOS 4.16.0, include an opensource third-party component which can be exploited from the local aCVE-2023-404685.5PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to dCVE-2023-404695.5PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to dCVE-2023-40478.8A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This v