CVE-2025-8679 is a critical authentication weakness in ExtremeGuest Essentials before 25.5.0. Repeated manual login attempts on certain captive portal setups can get an unauthenticated device marked as authenticated and given network access. Extreme Networks says the fix is in version 25.5.0 or later.
What's affected
- Product: ExtremeGuest Essentials, all versions before 25.5.0.
- Component: the captive portal, under certain SSID configurations.
- Weakness: CWE-307 (improper restriction of excessive authentication attempts).
- Score: CVSS 3.1 base 9.8, Critical, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is network reachable, low complexity, needs no privileges and no user interaction. - Fixed version: 25.5.0 or later, per Extreme Networks security advisory SA-2025-114.
The record and the advisory agree on the severity and the version. One naming difference is worth knowing. The record and the advisory title say ExtremeGuest Essentials, while the advisory's impact table lists the exposed product as ExtremeCloud IQ Essentials. Treat them as the same fix path, and confirm with the vendor if you run either name.
The record does not flag this CVE as exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog. The advisory I read did not say it was exploited either. Its description is that the issue works through a manual brute force procedure.
How to check if you're exposed
Find out whether you use ExtremeGuest Essentials, or ExtremeCloud IQ Essentials, for guest Wi-Fi with a captive portal, and which version it is on. The advisory page says only that the affected software is before 25.5.0, so the version shown in your management console is the check.
Then look at your captive portal SSID settings. The advisory says the issue appears under certain SSID configurations without naming them, so ask Extreme support which configurations apply if you cannot tell from the settings.
The advisory also gives one useful sign in your logs. Client360 logs may show a client's MAC address as the username even though MAC authentication is not enabled on that portal. If you see that for devices that never had a real login, someone may have been marked as authenticated through this weakness.
What to do now
- Identify every site or tenant that runs the guest portal and its version.
- Upgrade to 25.5.0 or later. The advisory lists no workaround that I could see, so the upgrade is the fix.
- After upgrading, review Client360 logs for clients whose username is a MAC address without MAC authentication being enabled.
- Check whether your guest network is isolated from internal systems, so that a bypass of the portal gives only internet access and not a path inward.
- Keep a note of the advisory number, SA-2025-114, so your audit trail shows when you fixed it.
Why it matters
A captive portal is a gate. Its job is to make a device prove it is allowed before it reaches the network. The weakness class is the lack of limits on repeated login attempts, so a device can keep trying until the system lets it through. Here the report goes further, and says that repeated attempts can flip the device to an authenticated state without valid credentials.
Guest Wi-Fi is often placed close to other systems, and many sites trust it less than they should. If your guest segment can reach anything internal, a bypass is worth more to an attacker than free internet. Segmentation limits the damage whatever the software does.
You can run the free in-browser dependency scan at gold.safeguard.sh/scan on your manifests to see which known-vulnerable packages you carry. It reads dependencies, so it will not see a flaw that lives only in an application's own source.
Quick check
Which version fixes it?
Version 25.5.0 or later, according to the Extreme Networks advisory SA-2025-114.
How would I know if someone used it?
The advisory says Client360 logs may show the client MAC address as the username even when MAC authentication is not enabled. That mismatch is the sign to look for.
Sources
- Safeguard Gold entry: CVE-2025-8679 (NVD record data: description, CVSS, CWEs, published 2025-10-01)
- Vendor advisory listed in the record: Extreme Networks SA-2025-114
Last reviewed: 18 October 2026.
