PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-6522 ExtremePacs CVE debrief

CVE-2023-6522 is an Extreme XDS vulnerability described as an incorrect use of privileged APIs that can allow collection of data as provided by users. The affected range is versions before 3914. The NVD record rates the issue 7.2 HIGH and describes it as remotely reachable without authentication or user interaction.

Vendor
ExtremePacs
Product
Extreme XDS
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-05
Original CVE updated
2026-05-20
Advisory published
2024-04-05
Advisory updated
2026-05-20

Who should care

Security, IT, and application teams that operate Extreme XDS deployments before 3914, especially instances reachable from untrusted networks or used in regulated environments.

Technical summary

The CVE description identifies an "Incorrect Use of Privileged APIs" issue in Extreme XDS, affecting versions before 3914. NVD lists CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, which indicates a network-reachable issue with no privileges or user interaction required and limited confidentiality and integrity impact. The supplied NVD record also shows vulnStatus "Deferred".

Defensive priority

High — the record indicates a remotely exploitable issue with no privileges or interaction needed, so affected deployments should be remediated promptly, starting with exposed systems.

Recommended defensive actions

  • Confirm whether Extreme XDS is deployed in your environment and identify all instances running versions before 3914.
  • Prioritize remediation for internet-facing or broadly reachable deployments.
  • Upgrade to version 3914 or later using vendor guidance and your normal change-control process.
  • Review any workflows that depend on privileged API handling before and after remediation.
  • Monitor the official NVD and USOM references for any follow-up advisory details.

Evidence notes

The source corpus states that Extreme XDS before 3914 is affected by an "Incorrect Use of Privileged APIs" vulnerability. The NVD-modified record includes CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N and vulnStatus "Deferred". Official references in the corpus point to USOM advisory pages at siberguvenlik.gov.tr and usom.gov.tr. The supplied vendor metadata is low-confidence and marked for review.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-6522 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-6522

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-6522 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-6522

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.