HPE AOS-CX CVE-2026-73750

Exploitation requires two concurrent conditions: (1) the target AOS-CX switch must be configured to use an external authentication backend (RADIUS, LDAP, TACACS+, or similar AAA protocol) for management-plane authentication, and (2) the attacker must control or have compromised a server that the switch is configured to trust as an authentication server - either by compromising the legitimate auth server or by performing a man-in-the-middle attack on the authentication channel. Switches using only local authentication are not exposed. The attack is initiated server-side: the hostile server must wait for or trigger an authentication request from the switch. No special privileges on the switch itself are required by the attacker; the attack surface is the trust the switch places in its configured authentication server. Limiting factors include the requirement to control trusted authentication infrastructure and the need for the switch to be reachable on the network and configured for external AAA.

The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H, score 8.8) captures network reachability and high impact but understates the actual attack complexity. Exploitation requires an attacker to already control or compromise a trusted authentication server that the target switch is configured to contact - a prerequisite that elevates practical difficulty well beyond what AC:L implies. That said, even a mid-sized municipal IT team in swidnica that relies on a shared RADIUS or LDAP server for switch administration faces meaningful risk if that central auth infrastructure is compromised, since a single hostile server could then pivot against every AOS-CX switch in the environment. No EPSS score is available, and neither KEV listing nor public POC has been identified, so real-world exploitation pressure is currently unconfirmed. The most significant risk amplifier is the potential for lateral movement across network infrastructure: RCE with elevated privileges on a core switch enables traffic interception, VLAN manipulation, and network-wide pivot. The CVSS vector's PR:L is ambiguous - the exploiting principal is a server-side actor, not a standard switch user - and AC:L misrepresents the auth-server-compromise prerequisite.

An attacker who has compromised a RADIUS or TACACS+ server trusted by the target AOS-CX switch crafts authentication response packets containing malformed or deliberately truncated fields. When an administrator attempts to log in - or when automated processes trigger an authentication exchange - the switch's authentication module processes the hostile server response and triggers a memory corruption condition. Depending on the nature of the flaw, this results in either a switch crash (DoS disrupting network operations) or arbitrary code execution running with elevated privileges on the switch OS.