CVE-2020-36907 HIGH

CVE-2020-36907: Extreme Networks Aerohive HiveOS <=11.x 11.x Unauthenticated Remote Denial of Service

Vendor Extreme Networks

Product Aerohive HiveOS

Weakness CWE-770 · Uncontrolled resource consumption

Published January 6, 2026

Last update March 23, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Aerohive HiveOS contains a denial of service vulnerability in the NetConfig UI that allows unauthenticated attackers to render the web interface unusable. Attackers can send a crafted HTTP request to the action.php5 script with specific parameters to trigger a 5-minute service disruption.

Key dates

02Disclosure timeline

January 6, 2026 CVE published

March 23, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-36907 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/770.html

Related vulnerabilities

04Related CVE

CVE-2026-29772 Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands CVE-2025-48988 Apache Tomcat: FileUpload large number of parts with headers DoS CVE-2022-3371 No limit in length of "Token name" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffweb CVE-2026-23963 Mastodon missing length limits on list names, filter names, and filter keywords CVE-2025-35965 DoS in Mattermost Playbooks via Excessive Task Actions