EUVD-2026-84672
GHSA-r27w-p7m3-4wqx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Unauthenticated remote crafted-input/interception (AV:N/AC:L/PR:N/UI:N); vendor-described partial disclosure, control-bypass, and DoS map to C:L/I:L/A:L with no scope change.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or intercepting network communications. Successful exploitation could result in the disclosure of sensitive information, bypass of security controls, or a denial of service condition on the affected system.
AnalysisAI
Unauthenticated remote access to an HPE Analytics and Location Engine (ALE) deployment can yield limited sensitive-information disclosure, partial bypass of security controls, or a partial denial of service. The flaw is network-reachable, low complexity, and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3), so it is exploitable by anyone able to reach the ALE service or to intercept and manipulate its network traffic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to an HPE Aruba Analytics and Location Engine (ALE) instance's exposed service; per CVSS PR:N/UI:N the attack is unauthenticated and needs no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3 HIGH) describes an unauthenticated, network-reachable, low-complexity flaw with no user interaction, but all three impact dimensions are rated LOW rather than HIGH - this is a broad but shallow weakness (partial info disclosure, limited integrity/security-control bypass, and partial DoS) rather than a full-system-compromise or RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | HPE's security bulletin (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US) is the authoritative source; the input data does not specify an exact fixed version, so patch status should be confirmed against that advisory and the corrected ALE build applied as directed by the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which ALE instances are deployed and their versions, verify that none are directly reachable from the public internet, and place every instance behind firewall rules or a VPN/zero-trust gateway that permits only known management and controller subnets; enable verbose logging and alerting on unexpected inbound connections to ALE service ports and preserve those logs for forensic review. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location En
Unauthenticated remote write access to the file system with elevated privileges in HPE Analytics and Location Engine (AL
Information disclosure in HPE ALE management interface allows unauthenticated remote attackers to retrieve sensitive sit
Unauthenticated data injection in HPE's Analytics and Location Engine (ALE) lets any attacker who can reach the ALE serv
Command execution in the HPE Analytics and Location Engine (ALE) web interface allows remote, high-privilege authenticat
Root-level file system access in HPE Analytics and Location Engine (ALE) can be obtained by an authenticated administrat
Root-level remote code execution in HPE Analytics and Location Engine (ALE) can be achieved when an attacker first estab
Unauthenticated, network-reachable attacks against HPE Aruba Analytics and Location Engine (ALE) can degrade or knock ou
Unauthenticated information disclosure in the HPE Aruba Analytics and Location Engine (ALE) API allows any remote attack
Same weakness CWE-200 – Information Exposure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today