EUVD-2026-69474
GHSA-8fwh-jw57-q6pr
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Admin privileges and high complexity required to reach the cleartext exposure; only partial confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability in the affected interface of HPE Networking Fabric Composer allows an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Fabric Composer.
AnalysisAI
Cleartext exposure of sensitive information in HPE Networking Fabric Composer's management interface can be triggered by an authenticated administrator, potentially revealing credentials or configuration data for downstream network services. The vulnerability requires both administrative privileges and high attack complexity (CVSS 2.2, AV:N/AC:H/PR:H), meaning realistic exploitability is limited to insiders or attackers who have already fully compromised an admin account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid administrative account on HPE Networking Fabric Composer (PR:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 2.2 places this at the lowest tier of severity, and the vector components support that rating: AV:N indicates the management interface is network-accessible, but AC:H and PR:H jointly require that the attacker already possess administrative credentials and satisfy an additional complexity prerequisite - making opportunistic remote exploitation implausible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the HPE security bulletin HPESBNW05133 at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05133en_us&docLocale=en_US for the official patched version and upgrade instructions - exact fix versions are not independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Fabric Composer
View allRemote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the applianc
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent ex
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network ex
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated lo
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escala
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elev
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full admin
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated att
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invo
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit busines
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today