EUVD-2026-84668
GHSA-xfrf-hcm4-q67f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Hard-coded credentials give an unauthenticated remote attacker (PR:N/AV:N/AC:L) full admin and OS access, yielding complete confidentiality, integrity and availability impact.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in using these known default credentials.
Successful exploitation could result in an attacker gaining unauthorized access to the application's management interface and the underlying operating system, potentially leading to full system compromise.
AnalysisAI
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location Engine (ALE) allow an unauthenticated remote attacker to log straight into the management interface and the underlying operating system, yielding full compromise of the appliance. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because no authentication, user interaction, or special configuration is required - the attacker only needs the known default secrets, which are typically published in advisories or recoverable from firmware - and there is no CISA KEV listing or public exploit code reported at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special configuration is required - the vulnerability stems from default, hard-coded credentials shipped on several administrative and system accounts of the ALE application and its underlying OS, exploitable remotely and unauthenticated (AV:N/PR:N/UI:N) against affected ALE deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to a genuine top-priority issue, not a CVSS-inflated paper tiger. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the HPE fix for ALE as directed by the vendor bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US - no exact fixed version number is present in the available intelligence, so verify the patched build in the advisory before upgrading; as of this analysis no vendor-released patch identifier can be confirmed from the supplied data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all HPE Analytics and Location Engine (ALE) deployments, immediately change every default administrative and system account credential to a unique strong password, and block management interface access from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote write access to the file system with elevated privileges in HPE Analytics and Location Engine (AL
Information disclosure in HPE ALE management interface allows unauthenticated remote attackers to retrieve sensitive sit
Unauthenticated data injection in HPE's Analytics and Location Engine (ALE) lets any attacker who can reach the ALE serv
Unauthenticated remote access to an HPE Analytics and Location Engine (ALE) deployment can yield limited sensitive-infor
Command execution in the HPE Analytics and Location Engine (ALE) web interface allows remote, high-privilege authenticat
Root-level file system access in HPE Analytics and Location Engine (ALE) can be obtained by an authenticated administrat
Root-level remote code execution in HPE Analytics and Location Engine (ALE) can be achieved when an attacker first estab
Unauthenticated, network-reachable attacks against HPE Aruba Analytics and Location Engine (ALE) can degrade or knock ou
Unauthenticated information disclosure in the HPE Aruba Analytics and Location Engine (ALE) API allows any remote attack
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today