EUVD-2026-46357
GHSA-8rj2-p5q2-rrfv
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CLI reachable over the network (AV:N) but requires existing admin privileges (PR:H); low complexity and no user interaction, with OS file access and RCE potential yielding high C/I/A.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
3DescriptionCVE.org
An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to remote code execution.
AnalysisAI
Privilege-to-RCE escalation in HPE Aruba Networking AOS-CX switch operating system allows an authenticated, high-privileged administrator to abuse a path traversal flaw in the CLI to copy arbitrary files from the underlying OS into a user-readable location, which can be leveraged to achieve remote code execution. The weakness affects the switch management CLI and requires existing administrative access; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high across confidentiality, integrity, and availability because it breaks the boundary between the constrained CLI and the underlying operating system.
Technical ContextAI
AOS-CX is HPE Aruba Networking's operating system that runs on CX-series enterprise/data-center switches, exposing a purpose-built command-line interface that is intended to constrain operators to network configuration commands rather than the underlying Linux-based OS. The reported issue is a path traversal (directory traversal, CWE-22 class - the input's CWE was listed as N/A) where a CLI command that handles file paths fails to sanitize traversal sequences, letting an operator reference files outside the intended directory and copy them into a location the user can read. Because the switch CLI normally sandboxes the operator away from OS internals, escaping that sandbox to read/stage arbitrary OS files (e.g., configuration, credential, or binary/script files) provides the primitive that the advisory says 'could lead to remote code execution.' The single affected CPE is cpe:2.3:a:hewlett_packard_enterprise_(hpe):aos-cx with an unspecified version field, so exact fixed builds must be taken from the HPE advisory.
RemediationAI
Apply the fixed AOS-CX firmware identified in HPE Aruba Networking security bulletin hpesbnw05081en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05081en_us&docLocale=en_US) - Patch available per vendor advisory; the input does not include an exact fixed build number, so the specific upgrade version must be confirmed from that advisory rather than assumed. Until patched, reduce exposure by tightly restricting who holds administrative/privileged CLI accounts (this flaw needs PR:H), enforcing role-based access so day-to-day operators cannot reach the file-copy commands, and placing switch management interfaces (SSH/management VLAN) behind a dedicated out-of-band management network with ACLs so only trusted admin hosts can reach the CLI. Enable and monitor CLI command auditing/AAA logging to detect anomalous file-copy or traversal-style paths; the trade-off is added logging overhead and the need to review logs, but it provides detection where no direct feature toggle for the vulnerable command is documented. Rotate administrative credentials if compromise is suspected, since the exploit presupposes valid privileged access.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows
Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged,
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper ha
Privilege escalation in HPE AOS-CX allows an authenticated low-privileged user to execute arbitrary commands with the pr
OS command injection in HPE AOS-CX's web-based management interface allows any authenticated low-privileged user to exec
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent netw
Unauthenticated command injection (CWE-77) in an HPE AOS-CX management component allows an adjacent-network attacker to
A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only p
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today