EUVD-2026-69470
GHSA-w3fv-769w-7rv4
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible management interface requires high-complexity on-path positioning; partial confidentiality impact only, no integrity or availability effect.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to gain insight into some data handled by the affected interface. A successful exploit could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise.
AnalysisAI
Unauthenticated remote information disclosure in HPE Networking Fabric Composer exposes cleartext data through the web-based management interface to network-positioned attackers. Exploitation demands high attack complexity (CVSS AC:H), constraining real-world risk despite the network-accessible, no-authentication vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to satisfy high attack complexity conditions (CVSS AC:H), most likely achieving an on-path or same-segment network position relative to the Fabric Composer web management interface - for example, being present on the management VLAN, performing ARP poisoning, or intercepting traffic between the interface and a network device. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 3.7 (Low) accurately reflects limited real-world impact: AC:H signals that exploitation is not trivial and likely requires specific network positioning such as an on-path or same-segment attacker, C:L limits the confidentiality exposure to partial data, and there is no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the HPE security advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US for patched version details and upgrade instructions; no exact fixed version number is derivable from the provided data, so the advisory is authoritative. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabric Composer
View allRemote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the applianc
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elev
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full admin
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated att
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today