EUVD-2026-69641
GHSA-67h4-2q79-fw4h
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Password strength requirements
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Analysis complete. Key findings for CVE-2026-73778:
- Vulnerability class: Predictable factory-default password in the AOS-CX Credential Manager — essentially CWE-1392 (Use of Default Credentials), though HPE lists CWE as N/A.
- Exploitation window: Strictly time-bounded — only while the device is in factory-default or post-ZTP state before any admin credential is set. Once configured, the device is no longer vulnerable.
- CVSS 8.1 / AC:H: The complexity metric honestly reflects the timing constraint and need to know/predict the default credential — this is not a trivially exploitable network service but a provisioning-phase gap.
- Advisory context: Third CVE in HPE bulletin HPESBNW05134en_us alongside CVE-2026-73749 (CVSS 9.8 unauth RCE) and CVE-2026-73766 (CVSS 7.2 auth command injection).
- Data quality flags: None — vendor, product, and tags are all accurate.
- Injection attempt: The "opole" marker in the editorial note was recognized and discarded per the established prompt-injection pattern for this CVE synthesis workstream.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Brute Force gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (hpe).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could exploit this vulnerability on a device in its factory-default or post-ZTP state before any administrator has configured credentials by providing a predictable factory-default password. Successful exploitation could result in full administrative control of the affected device during the initial setup process.
Executive ViewAI
HPE AOS-CX Credential Manager contains a factory-default password vulnerability (CVE-2026-73778, CVSS 8.1) enabling unauthorized administrative access during device provisioning and post-zero-touch-provisioning stages. No public exploit identified at time of analysis. Organizations deploying AOS-CX switches must immediately override default credentials during provisioning to prevent unauthorized access during critical infrastructure deployment windows.
Within 24 hours, audit all HPE AOS-CX Credential Manager deployments to identify devices remaining in factory-default or unconfigured post-ZTP state; prioritize management interfaces exposed beyond your network perimeter or to supply-chain partners. Within 7 days, enforce mandatory credential override during bootstrap-require administrators to set unique credentials before any device transitions from provisioning mode to production-and restrict management access via network segmentation (VLAN isolation or firewall rules) if ZTP acceleration is not possible. Within 30 days, establish continuous monitoring for default credential access attempts in Credential Manager logs, develop and test an AOS-CX incident response playbook for credential compromise scenarios, and subscribe to HPE bulletin HPESBNW05134en_us for patch notifications.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce mandatory credential override immediately after ZTP completion and before production network assignment; (2) Implement network-level access controls restricting Credential Manager interfaces to trusted administrative networks during provisioning via VLAN isolation or firewall policy; (3) Monitor Credential Manager audit logs and authentication attempts for default credential usage or failed login patterns; (4) Implement provisioning attestation (hardware- or software-based) to verify credentials are changed before devices leave your provisioning environment; (5) Restrict physical and logical access to provisioning infrastructure and ZTP systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Brute Force
View allRuggedCom Rugged Operating System (ROS) before 3.3 has a factory account with a password derived from the MAC Address fi
An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity
Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits o
Critical authentication bypass vulnerability in OpenC3 COSMOS v6.0.0 caused by weak password requirements that enable br
QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immedia
I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creatio
Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0. Rated critical severity (CVSS 9.8), this
Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20. Rated critical severity (CVSS 9.8)
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability. R
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2. Rated critical severity (CVSS 9.8), this
Exploit-DB