EUVD-2026-69628
GHSA-hr8p-9qx4-wjg9
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Adjacent-network reach limits exposure; auth bypass with no privileges needed drives PR:N; no confidentiality impact per description.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable unauthorized modification of affected resources and limited disruption of affected services.
AnalysisAI
Authentication bypass in the HPE AOS-CX switch operating system allows an unauthenticated attacker with adjacent network access to circumvent existing authentication controls, enabling unauthorized modification of switch resources and limited service disruption. Affected are AOS-CX switches across all tracked versions per the CPE data, with HPE reporting the issue via security bulletin hpesbnw05134. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be on the same network segment (Layer-2 adjacent) as the AOS-CX switch management interface - this is the primary limiting condition enforced by the AV:A CVSS metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) yields a score of 7.1, which reflects accurately constrained real-world exploitability: the adjacent-network requirement means an attacker must already be on the same Layer-2 segment or VLAN as the switch management interface, significantly reducing the exposed population relative to a fully internet-facing service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the HPE security bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US for the official patch and affected version details; no specific fixed firmware version is present in the available input data so a patched version cannot be cited here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct a complete inventory of all HPE AOS-CX switches, documenting firmware versions and identifying devices accessible from adjacent networks; implement emergency access restrictions to management interfaces. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged,
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper ha
Privilege escalation in HPE AOS-CX allows an authenticated low-privileged user to execute arbitrary commands with the pr
OS command injection in HPE AOS-CX's web-based management interface allows any authenticated low-privileged user to exec
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent netw
A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only p
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
Stored cross-site scripting in the HPE AOS-CX web-based management interface allows an authenticated attacker with high
Cross-site request forgery exposure in HPE AOS-CX switch web management interface enables remote unauthenticated attacke
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today