EUVD-2026-46356
GHSA-wmvw-hw56-3gpj
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CLI is remotely reachable (AV:N, AC:L) but requires high-privileged operator access (PR:H); code execution on the underlying OS yields full C:H/I:H/A:H, with S:U kept per vendor though CLI-to-OS breakout arguably warrants S:C.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
3DescriptionCVE.org
Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privileged user to execute arbitrary code as a privileged user on the underlying operating system.
AnalysisAI
Authenticated remote code execution affects the command-line interface of HPE Aruba Networking AOS-CX, the network operating system running on Aruba CX-series switches. Multiple buffer overflow flaws in the CLI let a high-privileged operator break out of the managed shell and run arbitrary code as a privileged user on the underlying operating system, converting administrative CLI access into full control of the switch OS. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Technical ContextAI
AOS-CX is HPE Aruba Networking's modern, database-driven switch operating system used across the CX switch portfolio (e.g., 6000/8000/9000 and 10000 series). The affected surface is the CLI itself - the restricted management shell that administrators use over SSH/console. Buffer overflow (memory-corruption class, aligned with CWE-120/CWE-121/CWE-787; the input lists CWE as N/A) occurs when CLI command parsing writes attacker-supplied input beyond an allocated buffer, allowing execution flow to be redirected into code that runs outside the CLI's intended sandbox and on the underlying Linux-based OS. The affected CPE is cpe:2.3:a:hewlett_packard_enterprise_(hpe):aos-cx:*:*:*:*:*:*:*:*, indicating all versions are in scope pending the fixed-version detail in the HPE advisory.
RemediationAI
Patch available per vendor advisory: upgrade AOS-CX firmware to the fixed version(s) specified in HPE Security Bulletin hpesbnw05081en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05081en_us&docLocale=en_US); apply the exact fixed release listed there for your switch model, as no fixed version number was included in the provided data and should not be assumed. Until patched, reduce exposure by tightly restricting who holds high-privileged CLI accounts and enforcing least privilege, requiring per-user TACACS+/RADIUS AAA with role-based command authorization instead of shared admin credentials, and limiting management-plane reachability by binding SSH/management to a dedicated out-of-band management VLAN or VRF with ACLs so only trusted admin hosts can reach the CLI (trade-off: tighter authorization and OOB isolation add operational overhead and can disrupt existing automation that relies on broad admin access). Enable command-accounting/audit logging to a remote syslog/SIEM to detect anomalous CLI activity, since exploitation requires an already-privileged session.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows
Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged,
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper ha
Privilege escalation in HPE AOS-CX allows an authenticated low-privileged user to execute arbitrary commands with the pr
OS command injection in HPE AOS-CX's web-based management interface allows any authenticated low-privileged user to exec
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent netw
Unauthenticated command injection (CWE-77) in an HPE AOS-CX management component allows an adjacent-network attacker to
A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only p
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
Same weakness CWE-120 – Classic Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today