EUVD-2026-84669
GHSA-xv49-cjp4-h46h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states an unauthenticated remote attacker gains elevated-privilege filesystem write leading to full compromise, so AV:N/PR:N/UI:N with C/I/A all High; scope unchanged as impact stays within the ALE host.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting in full system compromise.
AnalysisAI
Unauthenticated remote write access to the file system with elevated privileges in HPE Analytics and Location Engine (ALE) lets any attacker who can reach the product's internal administrative component overwrite files as a privileged user, with the potential for full system compromise. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction, and no special privileges are required against a vulnerable instance; the practical constraint is network reachability, since ALE admin interfaces are normally confined to internal management networks rather than exposed to the internet. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the internal administrative component of HPE ALE; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special privileges are needed against an affected instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-priority issue by every signal that is present. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Start by consulting the HPE security advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05137en_us&docLocale=en_US, which is the authoritative source for the affected ALE build list and the vendor-released fixed version; no specific fixed version number is present in the supplied data, so do not assume a version from this analysis - verify it directly against the advisory and upgrade or patch ALE accordingly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all instances of HPE Analytics and Location Engine (ALE) and immediately restrict network access to the internal administrative component using firewall rules or network segmentation, ensuring it is not reachable from untrusted networks or the internet. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location En
Information disclosure in HPE ALE management interface allows unauthenticated remote attackers to retrieve sensitive sit
Unauthenticated data injection in HPE's Analytics and Location Engine (ALE) lets any attacker who can reach the ALE serv
Unauthenticated remote access to an HPE Analytics and Location Engine (ALE) deployment can yield limited sensitive-infor
Command execution in the HPE Analytics and Location Engine (ALE) web interface allows remote, high-privilege authenticat
Root-level file system access in HPE Analytics and Location Engine (ALE) can be obtained by an authenticated administrat
Root-level remote code execution in HPE Analytics and Location Engine (ALE) can be achieved when an attacker first estab
Unauthenticated, network-reachable attacks against HPE Aruba Analytics and Location Engine (ALE) can degrade or knock ou
Unauthenticated information disclosure in the HPE Aruba Analytics and Location Engine (ALE) API allows any remote attack
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today