HPE AOS-CX CVE-2026-73760

Low-privilege authenticated access to the AOS-CX web-based management interface is required - the CVSS PR:L vector confirms credentials are necessary. The management interface must be network-reachable from the attacker's position (AV:N); in hardened deployments where the interface is bound to a dedicated management VLAN with ACL restrictions, an attacker must first have management-plane network access. No special non-default configuration of AOS-CX is required beyond the web management interface being enabled (its default state). The vulnerability is read-only - no file write, command execution, or availability impact is possible through this flaw alone. Exploitation is limited by the authentication prerequisite and, in well-segmented networks, by management-plane access controls.

The CVSS 6.5 score reflects a realistic, moderate-to-significant threat: network-accessible (AV:N), low-complexity (AC:L), authenticated (PR:L), with high confidentiality impact and no integrity or availability effect. The C:H rating is well-supported - path traversal on a network OS can expose /etc/shadow, SSH private keys, running configuration files containing SNMP community strings, or RADIUS shared secrets, all of which enable further compromise. The PR:L prerequisite meaningfully raises the bar against opportunistic mass scanning, but the credential threshold is low for an insider or an attacker who has already phished or reused credentials. Even a mid-sized municipal IT team in legnica managing campus switching infrastructure should treat this as urgent given the sensitive files a network OS filesystem typically contains. No EPSS data is provided, and the CVE does not appear in CISA KEV. However, this vulnerability shares advisory hpesbnw05134 with higher-severity AOS-CX issues including unauthenticated RCE (CVE-2026-73749, CVSS 9.8) and format-string adjacent RCE (CVE-2026-73782, CVSS 8.8), meaning coordinated exploitation - use a higher-severity bug to gain initial access, then use this traversal to harvest credentials for persistence - is plausible. No public exploit identified at time of analysis.

An attacker who has obtained low-privilege AOS-CX management credentials - via phishing, credential reuse from another compromised device, or the factory-default password issue in co-advisory CVE-2026-73778 - authenticates to the web-based management interface and submits crafted HTTP requests with path traversal sequences (e.g., GET /api/../../etc/shadow) targeting sensitive OS files. Returned file contents can include hashed or cleartext credentials, SNMP community strings, or SSH keys, enabling privilege escalation or lateral movement across the network.