EUVD-2026-69617
GHSA-7249-p86w-69v8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege AOS-CX CLI credentials
-
DeliveryConnect to switch via SSH over management network
-
ExploitExecute crafted CLI command targeting vulnerable operation
-
ExecutionTrigger privilege escalation to OS root
-
ImpactExecute arbitrary OS commands on switch
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) a valid low-privileged user account on the AOS-CX device with CLI access; (2) network reachability to the switch management interface (SSH or equivalent). The vulnerability is triggered through specific command-line operations - the exact CLI command or feature involved is not identified in the available data. This limits exploitation to authenticated insiders or external actors who have compromised a low-privilege credential. No special non-default configuration is stated as required beyond having a multi-tier CLI user model in place. What limits exploitation: authentication is required (PR:L), so unauthenticated external attackers cannot directly exploit; attack surface is the management plane, which should be isolated per best practice. If management VLAN access is restricted to trusted hosts, exposure is significantly reduced. |
| Impact | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a high-severity, low-complexity network attack requiring only a low-privileged credential - realistic in environments where read-only or operator-tier network accounts are provisioned. Full OS compromise (C:H/I:H/A:H) on a network switch is severe: it enables traffic interception, VLAN manipulation, route injection, and persistence. The Scope:Unchanged metric means direct impact is contained to the affected switch; however, lateral network damage from a compromised core switch can far exceed the CVSS scope model. No EPSS score is provided, KEV status is negative, and no POC is known, meaning exploitation is theoretical but plausible for any org with HPE Aruba CX switches and multi-tier CLI access policies. The primary risk population is enterprises using role-based CLI access (helpdesk, NOC, or junior engineers) on AOS-CX infrastructure. The 'Information Disclosure' tag in the input metadata is a mislabeling - this is a privilege escalation/RCE vulnerability. |
| Exploit ScenarioDerived | A network operator or helpdesk account holder with read-only or operator-tier AOS-CX CLI access connects via SSH to a managed switch and executes a crafted command that triggers the privilege escalation path. The attacker then runs arbitrary OS-level commands as root, gaining the ability to dump credentials, modify routing tables, disable spanning-tree, or install persistent backdoors on the switch firmware. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Privilege escalation in HPE AOS-CX allows an authenticated low-privileged user to execute arbitrary commands with the privileges of a higher-privileged or root-level account on the underlying operating system. The vulnerability is triggered through specific command-line operations within the AOS-CX CLI environment, making it exploitable over the network by any user with basic CLI credentials. With a CVSS score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields complete control of the affected switch's OS. No public exploit code and no CISA KEV listing are identified at time of analysis.
RemediationAI
Consult and apply the patch detailed in HPE Security Bulletin HPESBNW05134 at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US - an exact fixed AOS-CX firmware version is not available in the provided data and must be obtained directly from the bulletin. As a compensating control pending patch application, restrict CLI access (SSH/console) to only fully-trusted, privileged accounts - eliminate or suspend low-privilege CLI accounts. Enforce ACLs on management VLANs to limit who can reach the switch CLI over the network. Note that these controls raise the operational barrier for network operators but reduce the exploitable surface to accounts already trusted at the admin level.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HPE AOS-CX is the network operating system used across HPE Aruba CX-series switches, replacing the legacy ArubaOS-Switch platform. It provides a Linux-based OS with a structured CLI for switch management. The affected CPE is cpe:2.3:a:hewlett_packard_enterprise_(hpe):aos-cx:*:*:*:*:*:*:*:* (all versions at time of disclosure). The root-cause CWE is not assigned, but the description - 'execute arbitrary commands as a privileged user via command-line operations' - is consistent with OS command injection (CWE-78) or inadequate privilege separation in a privileged CLI helper (CWE-269). The attack vector is network-based (AV:N), most likely SSH-accessible CLI, meaning any low-privilege account granted remote CLI access is a potential attacker entry point.
Know when Aos Cx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable CLI (AV:N), no special conditions (AC:L), low-privilege auth required (PR:L), full OS-level impact on the vulnerable switch (C:H/I:H/A:H, S:U).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlying operating system.
Executive ViewAI
HPE AOS-CX switch operating systems are vulnerable to privilege escalation that allows any user with basic CLI login credentials to gain complete administrative control. With no vendor patch available and a CVSS score of 8.8 (full confidentiality, integrity, and availability impact), this vulnerability threatens any organization running HPE AOS-CX switches, enabling attackers to compromise critical network infrastructure, intercept traffic, and maintain persistent access across the network.
No vendor-released patch identified at time of analysis. Interim mitigations: Restrict CLI access to highly privileged, audited accounts only; implement real-time alerting on suspicious CLI command patterns and privilege-escalation attempts; use network segmentation and firewall rules to limit east-west movement from compromised switches; maintain backup network paths on unaffected hardware; escalate to HPE support for any undocumented configuration hardening or temporary workarounds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows
Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged,
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper ha
OS command injection in HPE AOS-CX's web-based management interface allows any authenticated low-privileged user to exec
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent netw
Unauthenticated command injection (CWE-77) in an HPE AOS-CX management component allows an adjacent-network attacker to
A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only p
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
Stored cross-site scripting in the HPE AOS-CX web-based management interface allows an authenticated attacker with high
Exploit-DB