EUVD-2026-69623
GHSA-x4q2-qmmg-jcfr
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent vector confirmed by description; unauthenticated DoS with no confidentiality or integrity impact matches A:H/C:N/I:N.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition by sending specially crafted packets. Successful exploitation of these vulnerabilities results in disruption of normal operation on affected devices.
AnalysisAI
Unauthenticated denial-of-service in HPE AOS-CX allows an adjacent-network attacker to crash or disrupt affected switches by sending specially crafted packets, resulting in loss of normal network operations. The vulnerability requires no credentials and no user interaction, making it exploitable by any actor with access to the same Layer-2 or adjacent network segment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must be on the same network segment (Layer-2 adjacency or equivalent) as the target AOS-CX switch - this is the primary limiting condition imposed by AV:A. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly characterizes a medium-severity, adjacency-constrained DoS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patch(es) identified in HPE security bulletin HPESBNW05134, available at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged,
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper ha
Privilege escalation in HPE AOS-CX allows an authenticated low-privileged user to execute arbitrary commands with the pr
OS command injection in HPE AOS-CX's web-based management interface allows any authenticated low-privileged user to exec
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent netw
A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only p
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
Stored cross-site scripting in the HPE AOS-CX web-based management interface allows an authenticated attacker with high
Cross-site request forgery exposure in HPE AOS-CX switch web management interface enables remote unauthenticated attacke
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today