CVE-2023-46271
Published: 19 February 2025
Summary
CVE-2023-46271 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Site (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2023-46271 is a buffer overflow vulnerability (CWE-120) affecting Extreme Networks IQ Engine versions before 10.6r1a and through 10.6r4 before 10.6r5. The flaw originates in the ah_webui service, which listens on TCP port 3009 by default.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), enabling an unauthenticated remote attacker with network access to trigger the buffer overflow. Successful exploitation could result in high-impact confidentiality, integrity, and availability violations, such as remote code execution or system compromise.
Advisories from Extreme Networks and the Zero Day Initiative detail mitigation steps, including upgrading to IQ Engine version 10.6r5 or later. Additional guidance is available in the Extreme Networks article at https://extreme-networks.my.site.com/ExtrArticleDetail?an=000115354&q=CVE-2023-46271 and the ZDI-23-1766 advisory at https://www.zerodayinitiative.com/advisories/ZDI-23-1766/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50498
Vulnerability details
Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has a buffer overflow. This issue arises from the ah_webui service, which listens on TCP port 3009 by default.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote buffer overflow in exposed ah_webui service on TCP 3009 directly enables remote code execution against a public-facing network application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely identification, reporting, and correction of system flaws, directly mitigating the buffer overflow by applying the vendor-recommended upgrade to IQ Engine 10.6r5 or later.
SC-7 enforces boundary protection to monitor and control communications, preventing unauthenticated remote exploitation over TCP port 3009 by filtering or blocking unauthorized network access to the ah_webui service.
SI-10 mandates validation of information inputs to detect and reject malformed data, directly countering the buffer overflow (CWE-120) triggered by unvalidated inputs to the vulnerable ah_webui service.