EUVD-2026-69616
GHSA-j26v-vfrm-7j84
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-only reach (AV:A) is correct for switch management APIs; unauthenticated arbitrary file write with RCE potential justifies PR:N and full C:H/I:H/A:H impact.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
2DescriptionCVE.org
An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution.
AnalysisAI
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent network segments. An attacker with Layer-2 or Layer-3 adjacency to the switch management plane can call a vulnerable API endpoint without credentials to overwrite arbitrary files on the underlying operating system, enabling remote code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires adjacent network connectivity (Layer-2 or Layer-3) to the AOS-CX management API interface - the CVSS AV:A metric confirms the attacker must reach the management plane from the same broadcast domain, VLAN, or directly routed segment; internet-based remote exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects an adjacent-network, unauthenticated attack with full CIA impact - the only risk-reducing factor is the adjacency constraint (AV:A rather than AV:N), which limits internet-scale exploitation but does not mitigate the threat in flat enterprise networks or environments where the switch management API is reachable from a compromised endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the HPE security bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US for exact patched firmware versions and upgrade instructions, as no specific fixed version is available in the current data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory HPE AOS-CX switch deployments and identify which reside on untrusted or adjacent network segments; immediately implement network segmentation and firewall rules restricting management plane access to authorized administrative networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows
Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged,
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper ha
Privilege escalation in HPE AOS-CX allows an authenticated low-privileged user to execute arbitrary commands with the pr
OS command injection in HPE AOS-CX's web-based management interface allows any authenticated low-privileged user to exec
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers
Unauthenticated command injection (CWE-77) in an HPE AOS-CX management component allows an adjacent-network attacker to
A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only p
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. Rated high severity (CVSS 8.8), this vulnerab
Stored cross-site scripting in the HPE AOS-CX web-based management interface allows an authenticated attacker with high
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today