HPE Networking EUVD-2026-108377

Exploitation requires the attacker to hold an adjacent-network position relative to the affected HPE networking device - the same Layer-2 segment, VLAN, or directly-connected/local network (AV:A), not a routable internet path. Within that position no authentication (PR:N) and no user interaction (UI:N) are needed and attack complexity is low (AC:L). The specific product feature, protocol, or configuration that triggers the flaw is not described in the available sources (no CVE description or CWE provided). The primary limiting factor is the adjacency requirement: an attacker must already be on or bridged into the local network, which excludes direct exploitation from the public internet.

The provided CVSS 3.1 vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a high-severity flaw that is unauthenticated (PR:N), low-complexity (AC:L), requires no user interaction (UI:N) and yields full confidentiality, integrity and availability impact - but only from an ADJACENT network position (AV:A), not from the internet at large. This adjacency requirement is the single most important risk-limiting signal and materially lowers real-world exposure versus an AV:N flaw of the same score. No EPSS probability, no CISA KEV listing and no POC/exploit reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_week', indicating elevated but non-emergency urgency - consistent with a serious but not actively-exploited adjacent-network vulnerability. CONFLICT TO VERIFY: the only tag is 'Information Disclosure', yet the CVSS vector asserts I:H and A:H (full integrity and availability loss), which is far broader than mere disclosure - the tag appears to understate the actual impact and should be verified against the HPE advisory. Additional MISSING data: there is no CVE description, no CWE, and no affected-version/fixed-version information in the input, so the mechanism and patch status cannot be confirmed here and must be read from the referenced HPE bulletin.

An attacker with a foothold on the same adjacent/local network segment as the affected HPE networking device (e.g. a connected VLAN or Wi-Fi segment) sends a crafted request to the device without needing credentials or user interaction, leading to full compromise of its confidentiality, integrity and availability. Because the attack vector is adjacent (AV:A) rather than network-routable, the attacker must already be positioned on or bridged into the local network. No public exploit code is identified at time of analysis.