Vulnerability Notice

We do not believe that ExtremeXOS 22.2 is significantly vulnerable to the “SSL 64-bit Block Size Cipher Suites Supported” (SWEET32) security risk.

SSL: ExtremeXOS uses the thttpd webserver that is not vulnerable to this type of attack because thttpd does not support persistent SSL connections, which is a requirement of the exploit.

SSH: SSH is potentially more vulnerable depending on the ciphers used. However, ExtremeXOS allows you to mitigate this vulnerability by configuring the advertised ciphers.

For more information about the SWEET32 threat, see:

https://sweet32.info

https://www.openssl.org/blog/blog/2016/08/24/sweet32/