EUVD-2026-108412
GHSA-h3r2-fvf8-3xxr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed HPE networking device over network
-
ExploitSend crafted unauthenticated request
-
ExecutionTrigger information-disclosure flaw
-
ImpactObtain limited sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVE has no description, so the exact feature, protocol, or configuration that triggers the flaw is not described in the available sources - only that the reference is an HPE networking bulletin (hpesbnw05162en_us). The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, unauthenticated exploitation needing no user interaction, implying no special configuration is required against affected deployments, but this cannot be confirmed without the description. Limiting factors: impact is low (vendor scores only I:L, no confidentiality or availability loss), the product is a specific HPE networking appliance rather than ubiquitous software, and reachability requires network exposure of the affected device. Affected versions and the exact triggering condition should be read directly from the HPE advisory. |
| Impact | This is a medium-severity issue (CVSS 5.3) whose signals point to a low-urgency, low-impact information exposure rather than a top priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw needing no privileges or user interaction, which maximizes reachability, but the impact metrics are minimal (C:N/I:L/A:N) - only a limited integrity impact and no confidentiality or availability impact per the vendor scoring. Note a conflict: the sole tag is 'Information Disclosure' (a confidentiality concern, normally C:L), yet the supplied vector sets C:N/I:L - one of these is likely mislabeled; the identical 5.3 score results either way, so this should be verified against the HPE bulletin. No EPSS score, CISA KEV listing, or POC/exploit reference was provided, so there is no evidence of exploitation; status is 'no public exploit identified at time of analysis.' The vuln.today Decision label is 'this_month,' consistent with a reachable-but-low-impact flaw that merits scheduled patching rather than emergency action. Overall this reads as a genuine-but-modest issue: easy to reach but low consequence, not a high-CVSS-but-illusory risk nor an emergency. |
| Exploit ScenarioDerived | A remote attacker with network reachability to an affected HPE networking product sends a request that, without authentication or user interaction, elicits limited unintended information or a limited integrity effect. The precise trigger is not described in the available sources. No public exploit or POC reference was provided. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
An unauthenticated, network-reachable information disclosure issue affects an HPE networking product documented in HPE security bulletin hpesbnw05162en_us; the CVSS 5.3 score reflects low integrity impact with no confidentiality or availability loss per the vendor's vector. Because no description was published, the specific feature, protocol, or configuration that triggers the flaw is not described in the available sources, and affected version ranges must be read directly from the HPE advisory. No public exploit code or CISA KEV confirmation accompanies this record, and the medium severity plus low impact place it in a this-month remediation window rather than an emergency one.
RemediationAI
Because the record contains no patch version and no fix reference beyond the vendor bulletin, the concrete remediation path is to retrieve HPE security bulletin hpesbnw05162en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US) and apply the firmware or software update it specifies for each listed model; patch availability is per the vendor advisory rather than independently confirmed here. Until the advisory's fixed build is applied, the only evidence-supported compensating measure is reducing network exposure of the affected device, since the vector requires network reachability (AV:N) with no authentication - segmenting management access or restricting which hosts can reach the appliance lowers the attack surface, at the cost of operational convenience for administrators. The available data does not describe a specific feature to disable, so no other workaround can be stated with confidence.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The record supplies no CWE classification and no description, so the root-cause class cannot be established from the available sources; the only technical anchor is the vendor reference, an HPE networking security bulletin (hpesbnw05162en_us). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U with I:L and C:N/A:N describes a flaw reachable over the network without authentication or user interaction, producing a limited integrity effect with no stated confidentiality or availability impact - the our-assessment vector instead scores C:L/I:N, so the impact category differs between vendor and analyst but both agree it is low. The specific subsystem of the appliance, whether management interface, web UI, or an exposed service, is not stated in the available data, and no CPE identifiers were provided to pin exact models or firmware branches.
Know when Hpe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network/unauth/low-complexity per supplied metrics; the 'Information Disclosure' tag indicates a limited confidentiality leak (C:L), differing from the vendor's I:L, yielding the same 5.3.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
No description provided
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a craf
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location En
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S
A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
NTP through 4.2.8p12 has a NULL Pointer Dereference. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
A maximum-severity, network-reachable flaw (CVSS 3.1 base 10.0) in an as-yet-unnamed HPE product allows remote attackers
Unauthenticated network attackers can potentially achieve high confidentiality, integrity, and availability impact again
HPE security bulletin hpesbnw05162en_us documents a maximum-severity (CVSS 10.0) exposure in an HPE product that is not
HPE advisory hpesbnw05162en_us covers a product flaw carrying a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H
Exploit-DB