CVE-2020-16152: The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine...

Security readout for executives and security teams

This issue affects Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine NetConfig UI through 10.0r8a. A remote attacker could abuse the administrative interface to run PHP code with root privileges, potentially taking full control of the device. The bundle does not state confirmed exploitation or a specific fixed version. Exposure is most relevant where ExtremeWireless Aerohive HiveOS or IQ Engine devices through 10.0r8a have NetConfig UI reachable by untrusted networks or weakly controlled administrative access. Treat this as a high-priority network infrastructure risk if affected devices are deployed. Root-level remote code execution on wireless infrastructure can affect availability, interception risk, and lateral movement, but urgency depends on whether NetConfig UI is exposed and whether vendor remediation has been applied. Mitigation focus: Inventory ExtremeWireless Aerohive HiveOS and IQ Engine deployments.; Identify devices running versions through 10.0r8a.; Restrict NetConfig UI access to trusted administrative networks..

Prepared

Jun 3, 2026, 02:08 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.