HPE AOS-CX EUVD-2026-69635

Exploitation requires the attacker to be on the same network segment or broadcast domain as the target AOS-CX device (adjacent network vector, AV:A). No authentication credentials are required (PR:N) and no user interaction is needed (UI:N). The attack requires only low complexity (AC:L), meaning no special race condition or precise memory layout knowledge is necessary beyond crafting packets that trigger the overflow. Impact is limited strictly to availability - the device crashes or its service is disrupted, with no confidentiality or integrity compromise possible through this vector. Exploitation from the open internet is not possible without prior access to the adjacent network segment, which limits the attacker population to insiders, hosts already on the LAN/VLAN, or attackers with existing foothold in the network.

The CVSS base score of 6.5 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a moderate-severity, availability-only DoS that requires no authentication and no user interaction but is constrained to adjacent-network attackers. The adjacency requirement substantially limits the realistic threat surface compared to a full internet-accessible vector, since exploitation requires being on the same broadcast domain, VLAN, or directly connected segment as the switch. No EPSS data or POC availability was provided, and the vulnerability is not in CISA KEV, indicating no confirmed active exploitation. The impact is purely availability - there is no confidentiality or integrity compromise - making this a service-disruption risk rather than a data-exposure or compromise scenario. Despite the moderate overall score, even a mid-sized municipal IT team in kalisz should treat this as operationally urgent if their core switching infrastructure runs unpatched AOS-CX and insider or lateral-movement threat models apply. The same advisory (hpesbnw05134) also covers higher-severity RCE and auth-bypass flaws in AOS-CX, making a consolidated patch cycle the pragmatic priority.

An attacker with access to the same network segment as an HPE AOS-CX switch - such as an insider, a compromised host on the same VLAN, or an attacker who has already achieved lateral movement - sends a sequence of specially crafted packets targeting the vulnerable AOS-CX service. The malformed packets trigger a buffer overflow in the service, crashing it and causing a disruption to normal OS operation, effectively taking the switch offline or degrading its forwarding capability.