EUVD-2026-46350
GHSA-p9m2-qm53-m92h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable CLI (AV:N) needs a valid low-privilege account (PR:L), no interaction, and code execution as privileged user yields full C/I/A impact (H/H/H).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
3DescriptionCVE.org
A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-privileged user to execute arbitrary code as a privileged user on the underlying operating system.
AnalysisAI
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged, authenticated user to exploit a buffer overflow in the command line interface (CLI) and run arbitrary code as a privileged user on the underlying switch operating system. Because the CVSS vector is AV:N/PR:L, an attacker who already holds any valid low-level CLI account (e.g., an operator-level login over SSH) can escalate to full device control. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; risk is driven by the high CVSS (8.8) and full C/I/A impact.
Technical ContextAI
AOS-CX is the network operating system that powers HPE Aruba Networking CX-series switches, exposing a management CLI typically reached over SSH or console. The flaw is a classic memory-safety defect (buffer overflow, aligned with CWE-120/CWE-787-class issues, though NVD lists CWE as N/A) in the CLI parsing/command-handling path: attacker-controlled input to a CLI command is copied without adequate bounds checking, corrupting adjacent memory and allowing hijack of execution flow. The CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):aos-cx:*:*:*:*:*:*:*:* identifies the affected software as the AOS-CX firmware/OS itself (all versions per the wildcard), running on the switch's embedded Linux-based OS where a privileged user maps to root-equivalent control of the device.
RemediationAI
Patch available per vendor advisory: upgrade AOS-CX to the fixed firmware train specified in HPE security bulletin hpesbnw05081en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05081en_us&docLocale=en_US); the exact fixed version is not included in the provided data and must be read from that advisory before deployment. Until switches are upgraded, reduce exposure by restricting CLI/management-plane access to a dedicated out-of-band management VLAN or ACL-protected subnet and permitting SSH only from trusted admin hosts (trade-off: legitimate remote admins must route through the management network), enforcing least privilege by auditing and removing unnecessary low-privileged CLI accounts and rotating credentials (trade-off: operational overhead for operator staff), and enabling RADIUS/TACACS+ centralized authentication with strong logging to detect anomalous CLI activity. These controls shrink the pool of accounts that can reach the vulnerable CLI but do not eliminate risk for legitimate low-privileged users, so patching remains the only complete fix.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper ha
Privilege escalation in HPE AOS-CX allows an authenticated low-privileged user to execute arbitrary commands with the pr
OS command injection in HPE AOS-CX's web-based management interface allows any authenticated low-privileged user to exec
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent netw
A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only p
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
Stored cross-site scripting in the HPE AOS-CX web-based management interface allows an authenticated attacker with high
Cross-site request forgery exposure in HPE AOS-CX switch web management interface enables remote unauthenticated attacke
Authentication bypass in HPE AOS-CX switch operating system allows an adjacent unauthenticated attacker, under high-comp
Same weakness CWE-120 – Classic Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today