EUVD-2026-29802
GHSA-5wfp-54cp-mj7h
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable management UI (AV:N) with low complexity, but requires an existing high-privilege admin session (PR:H); arbitrary file overwrite to RCE as privileged user yields full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system by exploiting improper input validation in the file path parameter. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system as a privileged user.
AnalysisAI
Arbitrary file overwrite leading to remote code execution affects HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) via the web-based management interface. An authenticated attacker with high privileges can abuse improper input validation in the certificate download function's file path parameter to overwrite arbitrary files and ultimately execute commands as a privileged OS user. There is no public exploit identified at time of analysis, EPSS is low (0.10%, 27th percentile), and CISA SSVC records no known exploitation.
Technical ContextAI
The affected component is the certificate download functionality in the AOS web management interface, the administrative UI for Aruba Mobility Controllers/Conductors and gateways running AOS-8 and cloud-native AOS-10. The root cause is improper validation of a user-supplied file path parameter, allowing path manipulation so that attacker-controlled content is written outside the intended location - a classic path-traversal/arbitrary-file-write primitive that is then leveraged to overwrite OS files and gain command execution as a privileged user. Note that the assigned CWE-296 (Improper Following of a Certificate's Chain of Trust) does not align with the described defect; the behavior described (improper input validation on a file path enabling arbitrary write, CWE-22/CWE-73 class) suggests the CWE mapping is imprecise and should be treated with caution.
RemediationAI
Patch available per vendor advisory (HPE bulletin hpesbnw05048en_us) - upgrade to the fixed AOS release for your branch above the last-affected versions listed (10.4.1.10, 10.7.2.2, 8.10.0.21, 8.12.0.6, 8.13.1.1, and the fixed 10.8.x train); exact fixed build numbers should be taken directly from the HPE bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US as they are not independently confirmed here. As compensating controls until patched, restrict access to the web-based management interface to a dedicated management VLAN or bastion hosts and block it from user/data networks and the internet (trade-off: administrators must use the management network/VPN), enforce least-privilege on administrative accounts and rotate/limit the high-privilege operator credentials the exploit requires (trade-off: tighter admin workflows), and enable strong authentication and monitoring/alerting on management-plane logins to detect misuse (trade-off: added operational overhead). Since exploitation requires an authenticated privileged session, limiting who holds and where they can use admin access is the most effective interim mitigation.
Remote code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an unauthenticated rem
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8) lets an unauthenticated remote attacker cras
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated a
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated a
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System
Command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless operating syst
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a high-privile
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS
Authenticated command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless
Authenticated command injection in HPE Aruba Networking's AOS-8 and AOS-10 wireless operating systems lets a high-privil
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System
Share
External POC / Exploit Code
Leaving vuln.today