EUVD-2026-29734
GHSA-7qhm-2x69-v62m
Severity by source
AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Adjacent management-interface XSS needing an admin to interact (AV:A, UI:R, PR:N); scope changes into the admin session (S:C), but as XSS the concrete integrity/availability impact on the device is limited (I:L/A:L).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.
AnalysisAI
Cross-site scripting in the web-based management interface of Aruba Access Points running AOS-10 and AOS-8 Instant allows an unauthenticated attacker on the adjacent local network to inject arbitrary JavaScript that executes in an authenticated administrator's browser. Successful exploitation can lead to theft of session/user data and manipulation of device configuration by riding the victim admin's privileges. No public exploit has been identified at time of analysis, and EPSS is low (0.12%), consistent with the SSVC assessment of no observed exploitation.
Technical ContextAI
The flaw is a CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. Cross-Site Scripting) issue in the HTTP(S) management UI served by Aruba Instant access points. AOS-8 Instant and AOS-10 are Hewlett Packard Enterprise (HPE) Aruba Networking operating systems for campus/branch wireless APs, where the AP itself hosts a browser-accessible administration console. The CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):arubaos_(aos) confirms ArubaOS as the affected software. Because the management interface fails to properly encode/sanitize attacker-controlled input, injected script is reflected or stored and then executed in the context of a legitimate admin session, which is why the CVSS scope is marked Changed (S:C) - the vulnerable web component is used to compromise a separate security authority (the admin's browser and, through it, device settings).
RemediationAI
Upgrade to a fixed ArubaOS build as directed in HPE advisory HPESBNW05049 (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US); the input data lists the last-affected versions per branch (e.g. 8.10.0.21, 8.12.0.6, 8.13.1.1, 10.4.1.10, 10.7.2.2, and 10.8.0.0), so apply the next remediated release for your branch as specified by HPE - exact fixed version numbers should be taken from the advisory rather than assumed. As a compensating control until patched, restrict access to the AP web management interface to a dedicated, isolated management VLAN and block HTTP/HTTPS management access from user/client networks (this counters the AV:A adjacency requirement but requires that admins reach the UI only from the management segment). Additionally, administrators should avoid browsing untrusted links while logged into the AP console and should log out of the management UI when not actively administering it, since exploitation depends on interaction within an authenticated admin session (UI:R).
More in Arubaos Aos
View allAuthenticated command injection in the command line interface of HPE Aruba Access Points running AOS-10 (10.7.x and abov
Authenticated OS command injection in HPE Aruba Networking Access Points running ArubaOS (AOS-10) allows a high-privileg
Authenticated command injection in the ArubaOS (AOS) command line interface allows a high-privileged remote operator on
XML entity expansion (CWE-776) in the DHCP XML handling component of HPE Aruba AOS Instant 8.x.x.x enables an unauthenti
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today