HPE Networking EUVD-2026-108373

Per the CVSS vector, exploitation requires the attacker to be on the same adjacent network as the affected HPE networking device (AV:A) - not routable from the open internet - but needs no authentication (PR:N) and no user interaction (UI:N), with low attack complexity (AC:L). The adjacency requirement is the primary limiting factor: the attacker must already have access to the relevant LAN/VLAN, wireless, or device-management segment. No description was provided, so any further configuration, feature, or deployment-mode prerequisites cannot be stated and must be confirmed against HPE advisory hpesbnw05162en_us.

The provided CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, base 9.3) describes an adjacent-network, low-complexity, unauthenticated flaw requiring no user interaction, with a scope change and high confidentiality and integrity impact but no availability impact - a severe profile for a networking device. The vuln.today decision label is 'act_now', which signals high prioritization. However, the key exploitation-probability signals are MISSING: no EPSS score, no CISA KEV listing, and no POC/exploit reference were provided, so there is no public evidence of active or likely-imminent exploitation to corroborate the 'act_now' label. The 'act_now' priority therefore appears driven by the high CVSS severity and vendor (HPE) advisory rather than by confirmed exploitation telemetry - treat it as a high-severity, high-priority patch item, not as a confirmed in-the-wild threat. Note also a signal conflict: the only tag is 'Information Disclosure', yet the CVSS vector asserts I:H (high integrity impact), so the issue is broader than disclosure alone - verify the full impact with the HPE advisory. No CVE description or CWE was supplied, so the exact vulnerability mechanism cannot be confirmed from the available data.

An attacker positioned on the same adjacent network segment as the affected HPE networking product (e.g., the same LAN, VLAN, or wireless/management network) sends crafted traffic to the device and, without authentication or user interaction, gains access to sensitive information and the ability to tamper with data, with effects crossing a security boundary (scope change). No public exploit or POC was identified in the provided data, so this scenario is inferred from the CVSS vector rather than demonstrated code. The precise trigger is not described in the available sources.