EUVD-2026-29803
GHSA-v9wq-j6gv-cw3q
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Requires high-privilege authenticated access to the management interface (PR:H), network-reachable and low-complexity, yielding full code execution and total confidentiality, integrity, and availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.
AnalysisAI
Command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless operating systems lets an authenticated, high-privileged remote attacker upload arbitrary files to the underlying OS, escalating to remote code execution as a privileged user. It affects multiple 8.x and 10.x controller/gateway branches and is fixed via the HPE security bulletin (hpesbnw05048en_us). There is no public exploit identified at time of analysis, and EPSS probability is low (0.26%), consistent with the CISA SSVC assessment of no known exploitation.
Technical ContextAI
The affected component is HPE Aruba Networking's AOS, the operating system running on Aruba mobility controllers and gateways (formerly ArubaOS), across the AOS-8 monolithic and AOS-10 cloud-managed architectures. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), where input reaching a privileged web-management function is not properly sanitized before being passed to an OS-level command or file-write operation, allowing an authenticated operator to write attacker-controlled files onto the device filesystem and achieve code execution. The single CPE (cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos)) confirms the affected software is the AOS platform itself rather than a specific hardware SKU, so exposure spans any controller/gateway running the listed firmware branches.
RemediationAI
Patch available per vendor advisory (HPE hpesbnw05048en_us) - no single exact fix version was provided in this data, but the affected ranges are bounded, so upgrade each branch to the first fixed release above its listed ceiling (i.e., beyond 8.13.1.1, 8.12.0.6, 8.10.0.21, 10.7.2.2, and 10.4.1.10, and off 10.8.0.0), confirming the exact target build against the HPE bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US before deploying. Because exploitation requires high-privilege authenticated access to the web management interface, effective compensating controls until patching are to restrict the management interface to a dedicated out-of-band or segmented management VLAN and permit access only from a hardened jump host, rotate and strengthen administrator credentials and enforce MFA/RBAC to shrink the privileged-operator population, and audit management-plane logins for anomalous file-upload or configuration activity; the trade-off is that tightening management-plane access can disrupt existing automation or remote-admin workflows and should be validated in a maintenance window.
Remote code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an unauthenticated rem
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8) lets an unauthenticated remote attacker cras
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated a
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated a
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a high-privile
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS
Authenticated command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless
Authenticated command injection in HPE Aruba Networking's AOS-8 and AOS-10 wireless operating systems lets a high-privil
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote att
Same weakness CWE-77 – Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today