EUVD-2026-29802
GHSA-5wfp-54cp-mj7h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to AOS management UI as privileged admin
-
DeliveryInvoke certificate download function
-
ExploitSubmit crafted file path parameter
-
ExecutionOverwrite arbitrary OS file
-
ImpactExecute commands as privileged user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V12 - Secure Communication Certificate chain validation
|
| Exploitation Conditions | Exploitation requires an authenticated session with high privileges (CVSS PR:H) on the AOS-8 or AOS-10 web-based management interface, and specifically the use of the certificate download functionality, where a crafted file path parameter bypasses input validation to overwrite an arbitrary file. Limiting factors: the attacker must already hold privileged administrative access to the management plane, network reachability to the web management UI is required, and only the listed AOS-8/AOS-10 version ranges are vulnerable. No user interaction is needed (UI:N) and complexity is low (AC:L), but the high-privilege gate and the need to reach the management interface substantially constrain realistic exploitation. |
| Impact | Signals are consistent and point to a real but not urgent issue. CVSS 7.2 (High) with AV:N/AC:L/PR:H/UI:N reflects network reachability and low complexity but a hard prerequisite of high privileges, which substantially narrows the attacker population to those who already hold administrative access to the management plane. EPSS is low (0.10%, 27th percentile) and CISA SSVC reports Exploitation: none and Automatable: no, though Technical Impact is total - meaning full compromise if exploited. No KEV listing and no POC. The main tension is between the 'total' technical impact and the low likelihood/high-privilege gate: the flaw is severe in outcome but gated behind existing admin authentication and shows no evidence of exploitation, so it is a patch-in-normal-cycle item rather than an emergency, unless the management interface is broadly exposed or shares credentials. |
| Exploit ScenarioDerived | An attacker who has obtained privileged administrator credentials for an Aruba controller (via phishing, credential reuse, or an insider) reaches the AOS web management interface over the network and invokes the certificate download function with a crafted file path parameter. By overwriting a sensitive OS file, they achieve arbitrary command execution as a privileged user on the controller. No public POC is known, so exploitation would require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Arbitrary file overwrite leading to remote code execution affects HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) via the web-based management interface. An authenticated attacker with high privileges can abuse improper input validation in the certificate download function's file path parameter to overwrite arbitrary files and ultimately execute commands as a privileged OS user. There is no public exploit identified at time of analysis, EPSS is low (0.10%, 27th percentile), and CISA SSVC records no known exploitation.
RemediationAI
Patch available per vendor advisory (HPE bulletin hpesbnw05048en_us) - upgrade to the fixed AOS release for your branch above the last-affected versions listed (10.4.1.10, 10.7.2.2, 8.10.0.21, 8.12.0.6, 8.13.1.1, and the fixed 10.8.x train); exact fixed build numbers should be taken directly from the HPE bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US as they are not independently confirmed here. As compensating controls until patched, restrict access to the web-based management interface to a dedicated management VLAN or bastion hosts and block it from user/data networks and the internet (trade-off: administrators must use the management network/VPN), enforce least-privilege on administrative accounts and rotate/limit the high-privilege operator credentials the exploit requires (trade-off: tighter admin workflows), and enable strong authentication and monitoring/alerting on management-plane logins to detect misuse (trade-off: added operational overhead). Since exploitation requires an authenticated privileged session, limiting who holds and where they can use admin access is the most effective interim mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the certificate download functionality in the AOS web management interface, the administrative UI for Aruba Mobility Controllers/Conductors and gateways running AOS-8 and cloud-native AOS-10. The root cause is improper validation of a user-supplied file path parameter, allowing path manipulation so that attacker-controlled content is written outside the intended location - a classic path-traversal/arbitrary-file-write primitive that is then leveraged to overwrite OS files and gain command execution as a privileged user. Note that the assigned CWE-296 (Improper Following of a Certificate's Chain of Trust) does not align with the described defect; the behavior described (improper input validation on a file path enabling arbitrary write, CWE-22/CWE-73 class) suggests the CWE mapping is imprecise and should be treated with caution.
Know when Hpe Aruba Networking Wireless Operating System Aos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable management UI (AV:N) with low complexity, but requires an existing high-privilege admin session (PR:H); arbitrary file overwrite to RCE as privileged user yields full C/I/A impact.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system by exploiting improper input validation in the file path parameter. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system as a privileged user.
Executive ViewAI
A remote code execution vulnerability (CVE-2026-44852, CVSS 7.2) affects HPE Aruba Networking AOS-8 and AOS-10 wireless platforms, allowing authenticated administrators to execute arbitrary commands through the web management interface. While no active exploitation has been observed and the attack requires high-level account privileges, compromise of wireless infrastructure could disrupt network access for all connected users and devices. The vulnerability poses meaningful risk to organizations heavily dependent on Aruba wireless systems for operational connectivity.
Until patch availability: restrict management interface access to authorized administrators only via network-level controls (VPN, jump hosts, IP whitelisting); implement robust logging and alerting for administrative certificate operations; monitor for suspicious file access patterns on affected systems; consider network segmentation to limit lateral movement if wireless controller is compromised; maintain offline backups of configuration files to enable rapid recovery.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Authenticated command injection in the CLI service reachable through the PAPI protocol on HPE Aruba Networking AOS-8 and
Command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 allows an authenticated
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS) 8.x and 10.x allows a remote use
Remote code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an unauthenticated rem
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8) lets an unauthenticated remote attacker cras
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated a
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated a
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System
Command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless operating syst
Exploit-DB