EUVD-2026-116207
GHSA-4fv6-968g-857p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitSend crafted oversized input
-
ExecutionTrigger buffer overflow in VIA
-
ImpactCrash service / deny availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an already-authenticated, low-privileged account on the affected HPE Networking VIA system (PR:L), per both the CVSS vector and the description. The description characterizes the actor as a 'local user,' which limits exploitation to those with existing local/account access and conflicts with the CVSS AV:N (network) designation - defenders should confirm whether remote authenticated access suffices or local access is mandatory. Impact is confined to denial of service (A:H); there is no confidentiality or integrity compromise. The specific feature, protocol, or input that triggers the overflow is not described in the available sources. No user interaction is required (UI:N). |
| Impact | This is a moderate-severity availability-only flaw (CVSS 6.5, A:H with C:N/I:N) whose real-world urgency is tempered by its impact profile and access requirements. The supplied CVSS vector reads CVSS:3.1/AV:N/AC:L/PR:L/UI:N, indicating a network-reachable, low-complexity, authenticated attack - but the description explicitly states 'authenticated low-privileged local user,' which contradicts AV:N and implies local access (AV:L). This AV:N-vs-'local user' conflict should be verified with HPE via advisory hpesbnw05173en_us; it materially changes exposure (remote vs. local). No EPSS score, KEV listing, or PoC reference is present in the input, so there is no evidence of active exploitation or public exploit code. The vuln.today decision label is 'this_month,' consistent with a non-emergency, authenticated, DoS-only issue rather than a top-priority emergency. Net assessment: a genuine but bounded risk - worth patching on a routine cycle, not an emergency - with the caveat that the attack vector field is internally inconsistent and needs vendor confirmation. |
| Exploit ScenarioDerived | An authenticated low-privileged user of HPE Networking VIA submits crafted input that triggers a buffer overflow, crashing or hanging the service and denying normal operation to legitimate users. No public exploit code is identified in the available data, and the flaw yields no confidentiality or integrity impact - only availability loss. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Denial of service in HPE Networking VIA: a buffer overflow can be triggered by an authenticated, low-privileged user, allowing the attacker to interrupt normal operation of the affected system. Impact is availability-only (CVSS 6.5, A:H with no confidentiality or integrity effect), and the trigger condition is not described in the available sources. No public exploit code has been identified at time of analysis, and the reference proof-of-concept status is unset; priority is rated this_month rather than immediate action. Note that the published CVSS vector uses AV:N while the description and independent assessment characterize the actor as a local user, so defenders should confirm whether remote authenticated access is sufficient or local access is mandatory.
RemediationAI
No fixed version is stated in the provided intelligence, so patch status is best described as: no vendor-released patch identified at time of analysis within this dataset - the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05173en_us&docLocale=en_US is the authoritative source for the fixed release and should be checked directly for the applicable HPE Networking VIA version. Because exploitation requires an already-authenticated, low-privileged account, exposure can be constrained in the interim by auditing and minimizing local accounts holding that privilege level and reviewing their activity; the vendor bulletin is the only reference supplied here, and any further workaround or mitigation should be taken from it rather than assumed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a buffer overflow, a memory-safety class in which input exceeding an expected buffer boundary corrupts adjacent memory; the CWE identifier was not supplied, so the precise root-cause variant (for example stack-based versus heap-based) is unconfirmed. The affected component is HPE Networking VIA, and no CPE strings or version ranges were provided with the intelligence, so the exact build scope cannot be pinned from the available data. Prerequisites are an existing authenticated, low-privileged account (PR:L, UI:N), with the outcome limited to a crash or service interruption (A:H) rather than code execution or data exposure. There is a documented inconsistency between the CVSS 3.1 vector's AV:N network designation and the description's 'local user' framing; the independent assessment adopts AV:L, and the specific feature, protocol or input that triggers the overflow is not described in the available sources.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Description specifies an authenticated low-privileged local user, so AV:L and PR:L; impact is denial of service only, hence C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A buffer overflow vulnerability exists in HPE Networking VIA that could allow an authenticated low-privileged local user to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected system.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB