HPE AOS-CX CVE-2026-73752

Exploitation requires adjacent network connectivity (Layer-2 or Layer-3) to the AOS-CX management API interface - the CVSS AV:A metric confirms the attacker must reach the management plane from the same broadcast domain, VLAN, or directly routed segment; internet-based remote exploitation is not possible. No authentication is required (PR:N) and no user interaction is needed (UI:N). Exploitation is constrained by access to the management network: switches whose management interfaces are isolated behind a dedicated out-of-band management VLAN with strict ACLs are substantially harder to reach. No special non-default configuration is required on the switch itself - all AOS-CX devices exposing their management API to adjacent networks appear to be at risk.

The CVSS 8.8 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects an adjacent-network, unauthenticated attack with full CIA impact - the only risk-reducing factor is the adjacency constraint (AV:A rather than AV:N), which limits internet-scale exploitation but does not mitigate the threat in flat enterprise networks or environments where the switch management API is reachable from a compromised endpoint. Low attack complexity and no required privileges or user interaction mean exploitation requires only connectivity to the management plane and knowledge of the vulnerable endpoint. No EPSS score was provided in the input, and the CVE is not listed in CISA KEV, so active exploitation is not confirmed. Even without a public exploit, any network team - whether running a large campus backbone or a smaller distributed environment - should treat this as urgent given that arbitrary file write on a managed switch constitutes a full device takeover primitive. CVSS accurately reflects severity; the sole real-world limiting factor is management plane isolation.

An attacker with a foothold on the same LAN or management VLAN as an AOS-CX switch sends an unauthenticated HTTP/REST API request to the vulnerable endpoint, specifying a crafted file path pointing to a startup script or cron job location and supplying attacker-controlled content. The switch OS writes the file without authentication checks, allowing the attacker to plant a backdoor or replace a binary that executes on the next switch restart or scheduled task cycle. No public proof-of-concept exploit has been identified at the time of analysis.