EUVD-2026-29738
GHSA-xrfm-m363-m483
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
DHCP is network-accessible without authentication, but mandatory user interaction and high complexity to align payload delivery constrain the attack; impact is pure availability with no C or I.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition. Successful exploitation could allow an attacker to cause excessive resource consumption upon user interaction, leading to service disruption or reduced availability of the affected system.
NOTE: This vulnerability only impacts Access Points running AOS Instant 8.x.x.x
AnalysisAI
XML entity expansion (CWE-776) in the DHCP XML handling component of HPE Aruba AOS Instant 8.x.x.x enables an unauthenticated remote attacker to cause denial-of-service via excessive resource consumption on affected Access Points. Exploitation requires both high attack complexity and user interaction (CVSS AV:N/AC:H/PR:N/UI:R), restricting the realistic attack surface to scenarios where a connected wireless client triggers the vulnerable DHCP parsing path. No active exploitation has been identified - EPSS stands at 0.07% (21st percentile), SSVC confirms exploitation status of none, and the vulnerability is absent from CISA KEV.
Technical ContextAI
CWE-776 (Improper Restriction of Recursive Entity References in DTDs) describes the classic 'Billion Laughs' or XML Entity Expansion attack class: a maliciously crafted XML document containing recursively nested entity definitions causes the parser to expand them exponentially, exhausting CPU and memory without bound. The vulnerable component here is the XML parser embedded within the AOS-8 DHCP service layer, which processes XML-formatted input as part of DHCP transaction handling on HPE Aruba Instant-mode Access Points. The CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):arubaos_(aos):*:*:*:*:*:*:*:* covers the ArubaOS platform broadly; the CVE description scopes impact strictly to Access Points operating in AOS Instant (AP-mode) under the 8.x branch, explicitly excluding other deployment modes.
RemediationAI
The primary fix is to upgrade affected Access Points to a patched ArubaOS version as directed by HPE security advisory hpesbnw05049en_us at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US. Exact fixed release numbers per branch (8.10.x, 8.12.x, 8.13.x) are not independently confirmed from the available intelligence data and must be obtained directly from the HPE advisory. As a compensating control pending patching, restrict network access to DHCP services on affected Access Points at the network perimeter or via ACL to allow only trusted DHCP relay agents and authorized subnets - note that overly broad restriction will break legitimate DHCP client service. Additionally, monitoring Access Point resource utilization for anomalous spikes in CPU or memory consumption can provide early warning of exploitation attempts.
More in Arubaos Aos
View allCross-site scripting in the web-based management interface of Aruba Access Points running AOS-10 and AOS-8 Instant allow
Authenticated command injection in the command line interface of HPE Aruba Access Points running AOS-10 (10.7.x and abov
Authenticated OS command injection in HPE Aruba Networking Access Points running ArubaOS (AOS-10) allows a high-privileg
Authenticated command injection in the ArubaOS (AOS) command line interface allows a high-privileged remote operator on
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today