EUVD-2026-29806
GHSA-m5f2-69j5-q9vw
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitation requires an existing administrative CLI session (PR:H) over a network-reachable interface with low complexity (AC:L), yielding total code-execution impact (C:H/I:H/A:H) confined to the device (S:U).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.
AnalysisAI
Authenticated command execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an administrator to escalate from the CLI to the underlying OS by triggering stack-based buffer overflows in several management service components. An attacker who already holds administrative CLI credentials can send crafted requests to these services and run arbitrary code with elevated (root-level) privileges on the controller or gateway. There is no public exploit identified at time of analysis, and EPSS is low (0.07%), consistent with the CISA SSVC assessment of no known exploitation.
Technical ContextAI
The affected components are internal management services that AOS exposes to the device command-line interface on Aruba wireless controllers, mobility gateways, and access points running AOS-8 or AOS-10. The root cause is CWE-121 (stack-based buffer overflow): several of these CLI-reachable services copy attacker-influenced input into fixed-size stack buffers without adequate bounds checking, allowing return addresses or saved stack state to be overwritten. Because these services run as privileged processes on the embedded OS beneath the CLI abstraction, a successful overflow converts an administrative CLI session into arbitrary native code execution. The affected product per CPE is cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos), reported directly by HPE.
RemediationAI
Apply the fixed AOS builds referenced in HPE Security Bulletin hpesbnw05048en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US); upgrade each affected train to a release above the listed ceilings (for example, beyond 10.7.2.2 on the 10.7 train, beyond 8.13.1.1 on the 8.13 train, and to the vendor-designated fixed builds for the 10.4, 10.8, 8.12 and 8.10 trains) - Patch available per vendor advisory, with exact fixed builds to be confirmed from the HPE bulletin. Because exploitation requires an authenticated administrative CLI session, the highest-value compensating controls are to restrict and harden management-plane access: limit CLI/management reachability to a dedicated out-of-band management VLAN or trusted jump hosts via ACLs (trade-off: legitimate remote admins must route through that path), enforce strong, unique admin credentials with MFA where supported, and audit administrator accounts for reuse or default passwords. Monitor management-service logs for crashes or malformed CLI requests as an early indicator of exploitation attempts.
Remote code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an unauthenticated rem
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8) lets an unauthenticated remote attacker cras
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated a
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated a
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System
Command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless operating syst
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a high-privile
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS
Authenticated command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless
Authenticated command injection in HPE Aruba Networking's AOS-8 and AOS-10 wireless operating systems lets a high-privil
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today