PatchSiren cyber security CVE debrief
CVE-2023-6522 ExtremePacs CVE debrief
CVE-2023-6522 is an Extreme XDS vulnerability described as an incorrect use of privileged APIs that can allow collection of data as provided by users. The affected range is versions before 3914. The NVD record rates the issue 7.2 HIGH and describes it as remotely reachable without authentication or user interaction.
- Vendor
- ExtremePacs
- Product
- Extreme XDS
- CVSS
- HIGH 7.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2024-04-05
- Original CVE updated
- 2026-05-20
- Advisory published
- 2024-04-05
- Advisory updated
- 2026-05-20
Who should care
Security, IT, and application teams that operate Extreme XDS deployments before 3914, especially instances reachable from untrusted networks or used in regulated environments.
Technical summary
The CVE description identifies an "Incorrect Use of Privileged APIs" issue in Extreme XDS, affecting versions before 3914. NVD lists CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, which indicates a network-reachable issue with no privileges or user interaction required and limited confidentiality and integrity impact. The supplied NVD record also shows vulnStatus "Deferred".
Defensive priority
High — the record indicates a remotely exploitable issue with no privileges or interaction needed, so affected deployments should be remediated promptly, starting with exposed systems.
Recommended defensive actions
- Confirm whether Extreme XDS is deployed in your environment and identify all instances running versions before 3914.
- Prioritize remediation for internet-facing or broadly reachable deployments.
- Upgrade to version 3914 or later using vendor guidance and your normal change-control process.
- Review any workflows that depend on privileged API handling before and after remediation.
- Monitor the official NVD and USOM references for any follow-up advisory details.
Evidence notes
The source corpus states that Extreme XDS before 3914 is affected by an "Incorrect Use of Privileged APIs" vulnerability. The NVD-modified record includes CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N and vulnStatus "Deferred". Official references in the corpus point to USOM advisory pages at siberguvenlik.gov.tr and usom.gov.tr. The supplied vendor metadata is low-confidence and marked for review.
Official resources
CVE-2023-6522 was published on 2024-04-05. The supplied NVD record was last modified on 2026-05-20. It is not marked as a KEV entry in the provided corpus.