AOS-CX Switches Security Flaws

Auth bypass in HPE Aruba AOS-CX switch web management.

Authenticated remote attackers can execute arbitrary commands through malformed parameters in AOS-CX CLI commands, achieving remote code execution with high integrity and confidentiality impact. The vulnerability affects low-privileged users on networked systems and requires no user interaction to exploit. No patch is currently available for this command injection flaw.

OS command injection in the CLI of HPE Aruba Networking AOS-CX switches (CWE-78) lets an authenticated remote attacker with low-privilege credentials run arbitrary commands on the underlying operating system, yielding full compromise of confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only users who hold valid CLI credentials and can reach the switch management interface (SSH or console management plane) are able to trigger the flaw, so restricting management-plane access to a dedicated network sharply reduces exposure. EPSS places exploitation likelihood at roughly 0.12% (31st percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so this is a latent, credentialed post-authentication risk rather than an actively exploited campaign.

Authenticated administrators of AOS-CX Switches can inject arbitrary commands through a custom binary in the CLI, potentially compromising switch integrity and network operations. This high-privilege attack requires valid credentials and direct network access but carries no patch availability, leaving affected deployments at persistent risk.

web-based management interface of AOS-CX Switches is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).