CVE-2025-8679 - CVE House
Back to Database
Status published High CVE-2025-8679

ExtremeGuest Essentials Captive Portal Unauthenticated Brute Force

Vulnerability Description

In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access. Client360 logs may display the client MAC as the username despite no MAC-authentication being enabled.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-8679

Credits & Attribution

No credits recorded in the NVD database.

References

More from Extreme Networks

View All →
CVE-2025-6235
ExtremeControl (NAC) 'onmouseover' XSS
Medium 5.3
CVE-2025-6083
ExtremeCloud Universal ZTNA Improper Authorization
Medium 5.2
CVE-2025-11192
Fabric Engine (VOSS) AutoSense Authentication Bypass
High 8.4
CVE-2020-36907
Extreme Networks Aerohive HiveOS <=11.x 11.x Unauthenticated Remote Denial of Service
High 8.7

Affected Vendor

Extreme Networks

View all reports →

Affected Software

ExtremeGuest Essentials
Vulnerable Versions:
25.4.0

Timeline

Official Publish: October 1st, 2025
Last Modified: October 1st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-307

MITRE ATT&CK TTPs

T1110 Brute Force
Credential Access
T1078 Valid Accounts
Persistence
T1550 Use Alternate Authentication Material
Defense Evasion
T1021 Remote Services
Lateral Movement
T1562 Impair Defenses
Defense Evasion