---
id: CVE-2025-8679
title: >-
  In ExtremeGuest Essentials before 25.5.0, captive-portal may permit
  unauthorized access via manual brute-force procedure
summary: >-
  In ExtremeGuest Essentials before 25.5.0, captive-portal may permit
  unauthorized access via manual brute-force procedure. Under certain
  ExtremeGuest Essentials captive-portal SSID configurations, repeated manual
  login attempts may allow …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-307
vendor: extremenetworks
product: extremeguest_essentials
affected:
  - extremeguest_essentials < 25.5.0
patched:
  - extremeguest_essentials 25.5.0
published: '2025-10-01'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:10:00.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-8679'
references:
  - url: 'https://extreme-networks.my.site.com/ExtrArticleDetail?an=000130289'
    label: 1c053176-eef3-4d6a-ae0b-24728c86587b
tags:
  - nvd
epss: 0.00339
epssPercentile: 0.25451
ingestedAt: '2026-10-12T15:55:08.062Z'
---

## Overview

In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access. Client360 logs may display the client MAC as the username despite no MAC-authentication being enabled.

## Affected

- `extremeguest_essentials < 25.5.0`

## Remediation

Upgrade past the affected range:

- `extremeguest_essentials 25.5.0`