EUVD-2026-46350
GHSA-p9m2-qm53-m92h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain low-privileged CLI account
-
DeliveryConnect to AOS-CX CLI via SSH
-
ExploitSubmit crafted oversized CLI command
-
InstallOverflow buffer in CLI parser
-
C2Hijack execution flow
-
ExecuteExecute code as privileged user
-
ImpactFull control of switch
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) network or console reachability to the AOS-CX command line interface, typically SSH to the switch management interface, and (2) valid low-privileged CLI credentials (PR:L) - this is an authenticated attack, not pre-auth. The specific vulnerable component is the AOS-CX CLI command parser, triggered by supplying crafted/oversized input to a CLI command. Limiting factors that reduce realistic risk: the attacker must already authenticate with at least a low-privilege account, and exposure is confined to whoever can reach the management plane, so switches whose CLI is restricted to an out-of-band management network are far harder to reach. No user interaction is required (UI:N) and attack complexity is low (AC:L) once a valid account and CLI access are held. |
| Impact | The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - network reachable, low complexity, only low privileges required, no user interaction, and full confidentiality/integrity/availability impact. The key limiting factor is PR:L: this is an authenticated escalation, not an unauthenticated pre-auth RCE, so an attacker must first possess a valid low-privileged CLI account or credentials. There is no EPSS score, no KEV listing, and no POC in the provided data, so real-world exploitation pressure appears lower than the raw score suggests; treat this as a serious but not emergency patch, prioritizing switches where low-privilege accounts are broadly issued or where management planes are exposed. Note: the description labels this 'remote' and the vector uses AV:N, consistent with SSH-based CLI access - verify whether the management interface is reachable beyond a trusted management VLAN, as that materially changes exposure. |
| Exploit ScenarioDerived | An attacker who has obtained a low-privileged AOS-CX operator account - via phishing, credential reuse, or an insider - connects to the switch CLI over SSH and issues a specially crafted command containing an oversized argument that overflows a fixed-size buffer in the CLI handler. The overflow overwrites control data and executes attacker-supplied code as a privileged (root-equivalent) user, giving full control of the switch. No public exploit is identified at time of analysis, but the low complexity (AC:L) means a working exploit would be reliable once developed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged, authenticated user to exploit a buffer overflow in the command line interface (CLI) and run arbitrary code as a privileged user on the underlying switch operating system. Because the CVSS vector is AV:N/PR:L, an attacker who already holds any valid low-level CLI account (e.g., an operator-level login over SSH) can escalate to full device control. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; risk is driven by the high CVSS (8.8) and full C/I/A impact.
RemediationAI
Patch available per vendor advisory: upgrade AOS-CX to the fixed firmware train specified in HPE security bulletin hpesbnw05081en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05081en_us&docLocale=en_US); the exact fixed version is not included in the provided data and must be read from that advisory before deployment. Until switches are upgraded, reduce exposure by restricting CLI/management-plane access to a dedicated out-of-band management VLAN or ACL-protected subnet and permitting SSH only from trusted admin hosts (trade-off: legitimate remote admins must route through the management network), enforcing least privilege by auditing and removing unnecessary low-privileged CLI accounts and rotating credentials (trade-off: operational overhead for operator staff), and enabling RADIUS/TACACS+ centralized authentication with strong logging to detect anomalous CLI activity. These controls shrink the pool of accounts that can reach the vulnerable CLI but do not eliminate risk for legitimate low-privileged users, so patching remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AOS-CX is the network operating system that powers HPE Aruba Networking CX-series switches, exposing a management CLI typically reached over SSH or console. The flaw is a classic memory-safety defect (buffer overflow, aligned with CWE-120/CWE-787-class issues, though NVD lists CWE as N/A) in the CLI parsing/command-handling path: attacker-controlled input to a CLI command is copied without adequate bounds checking, corrupting adjacent memory and allowing hijack of execution flow. The CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):aos-cx:*:*:*:*:*:*:*:* identifies the affected software as the AOS-CX firmware/OS itself (all versions per the wildcard), running on the switch's embedded Linux-based OS where a privileged user maps to root-equivalent control of the device.
Know when Aos Cx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable CLI (AV:N) needs a valid low-privilege account (PR:L), no interaction, and code execution as privileged user yields full C/I/A impact (H/H/H).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-privileged user to execute arbitrary code as a privileged user on the underlying operating system.
Executive ViewAI
A privilege escalation vulnerability in HPE Aruba Networking AOS-CX switches (CVE-2026-44880, CVSS 8.8) enables any authenticated operator-level user to gain full administrative control over critical network infrastructure through a CLI buffer overflow. This directly threatens network availability and confidentiality, as a low-privileged employee or compromised operator account can escalate to complete device takeover. Organizations operating these switches should prioritize immediate access controls and monitoring until a vendor patch becomes available.
No vendor-released patch identified at time of analysis. Interim mitigations include: restricting CLI access to authorized network administrators only via SSH key authentication; centralized audit logging and real-time alerting for all switch CLI activity; network segmentation to isolate switches from user-accessible networks; and multi-factor authentication for administrative accounts where supported by the switch platform. Continuously monitor HPE security advisories for patch releases.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows
Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper ha
Privilege escalation in HPE AOS-CX allows an authenticated low-privileged user to execute arbitrary commands with the pr
OS command injection in HPE AOS-CX's web-based management interface allows any authenticated low-privileged user to exec
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent netw
Unauthenticated command injection (CWE-77) in an HPE AOS-CX management component allows an adjacent-network attacker to
A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only p
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
Stored cross-site scripting in the HPE AOS-CX web-based management interface allows an authenticated attacker with high
Exploit-DB