HPE AOS-CX EUVD-2026-69645

The attacker must be positioned on the same Layer 2 network segment or management VLAN as the target AOS-CX switch - full internet-based exploitation is not possible without a prior network foothold. No credentials are required (PR:N), and no user interaction is needed. The vulnerable path resides in the AOS-CX CLI service itself, reachable before credential validation completes. No special non-default configuration is required; the CLI is enabled by default on AOS-CX switches. Exploitation is limited by adjacency: deployments that isolate switch management interfaces to a tightly controlled out-of-band network behind strict ACLs significantly reduce reachable attack surface.

The CVSS 8.8 score (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity, low-complexity, unauthenticated threat bounded by the adjacent-network attack vector. The adjacency requirement (AV:A) is the primary exploit limiter - the attacker must have a foothold on the same Layer 2 segment or management VLAN as the target switch. However, because AOS-CX devices are themselves network control-plane infrastructure, code execution on a switch as a privileged user is asymmetrically impactful: an adversary who achieves this gains the ability to manipulate routing tables, intercept or redirect traffic across all connected VLANs, and move laterally throughout the network. The simultaneous disclosure of this flaw alongside three other high- and critical-severity AOS-CX CVEs in bulletin HPESBNW05134 suggests a coordinated research campaign that may accelerate exploit development even absent a current public PoC. EPSS data was not provided; KEV status is not confirmed. For prioritization purposes, any AOS-CX deployment where the management plane is reachable from general-purpose network segments - rather than a strictly segmented out-of-band management network - faces materially elevated risk.

An attacker with a compromised host on the management VLAN initiates an SSH or Telnet connection to an AOS-CX switch and submits a crafted input string containing format specifiers (e.g., sequences of %n or %x) to the CLI service before authentication is fully resolved. The underlying OS format function processes the attacker-controlled string directly, allowing the attacker to overwrite a return address or function pointer, redirecting execution to shellcode or a ROP chain and achieving arbitrary code execution as a privileged system user. No public exploit code has been identified at time of analysis.