Arubaos Cx
Monthly
OS command injection in the CLI of HPE Aruba Networking AOS-CX switches (CWE-78) lets an authenticated remote attacker with low-privilege credentials run arbitrary commands on the underlying operating system, yielding full compromise of confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only users who hold valid CLI credentials and can reach the switch management interface (SSH or console management plane) are able to trigger the flaw, so restricting management-plane access to a dedicated network sharply reduces exposure. EPSS places exploitation likelihood at roughly 0.12% (31st percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so this is a latent, credentialed post-authentication risk rather than an actively exploited campaign.
Authenticated administrators of AOS-CX Switches can inject arbitrary commands through a custom binary in the CLI, potentially compromising switch integrity and network operations. This high-privilege attack requires valid credentials and direct network access but carries no patch availability, leaving affected deployments at persistent risk.
Authenticated remote attackers can execute arbitrary commands through malformed parameters in AOS-CX CLI commands, achieving remote code execution with high integrity and confidentiality impact. The vulnerability affects low-privileged users on networked systems and requires no user interaction to exploit. No patch is currently available for this command injection flaw.
Auth bypass in HPE Aruba AOS-CX switch web management.
web-based management interface of AOS-CX Switches is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).
A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ArubaOS-CX web management interface session fixation allows an authenticated remote attacker with low-privilege credentials to hijack an active user session when a legitimate user interacts with the interface, potentially viewing or modifying sensitive switch configuration. The CVSS 7.3 flaw requires reachability to the management UI and victim interaction, with no availability impact; EPSS is low at 0.05% and no public exploit was identified at time of analysis. Environments that expose the web UI to multiple administrators and broad networks have the highest practical exposure.
Authenticated remote attackers holding low-privilege management access to HPE Aruba Networking AOS-CX switches can inject arbitrary OS commands through a management-plane function, resulting in remote code execution with high confidentiality, integrity, and availability impact. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is a credible mid-to-high priority but not an emergency; EPSS is 0.13% (32nd percentile) and no public exploit code was identified at time of analysis. The main exposure is organizations that allow management access from broad networks or grant operator-level accounts more widely than necessary.
Authenticated command injection in HPE ArubaOS-CX allows a remote attacker who already holds valid management credentials to execute arbitrary OS commands, with potential for full Remote Code Execution on the switch. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact, but the mandatory authenticated access and typical management-network segregation reduce exposure. No public exploit was identified at time of analysis, and EPSS is low at 0.13% (32nd percentile).
A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: - AOS-CX 10.14.xxxx : All patches -. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. Rated low severity (CVSS 3.4), this vulnerability is no authentication required. No vendor patch available.
An authenticated command injection vulnerability exists in the AOS-CX command line interface. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
OS command injection in the CLI of HPE Aruba Networking AOS-CX switches (CWE-78) lets an authenticated remote attacker with low-privilege credentials run arbitrary commands on the underlying operating system, yielding full compromise of confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only users who hold valid CLI credentials and can reach the switch management interface (SSH or console management plane) are able to trigger the flaw, so restricting management-plane access to a dedicated network sharply reduces exposure. EPSS places exploitation likelihood at roughly 0.12% (31st percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so this is a latent, credentialed post-authentication risk rather than an actively exploited campaign.
Authenticated administrators of AOS-CX Switches can inject arbitrary commands through a custom binary in the CLI, potentially compromising switch integrity and network operations. This high-privilege attack requires valid credentials and direct network access but carries no patch availability, leaving affected deployments at persistent risk.
Authenticated remote attackers can execute arbitrary commands through malformed parameters in AOS-CX CLI commands, achieving remote code execution with high integrity and confidentiality impact. The vulnerability affects low-privileged users on networked systems and requires no user interaction to exploit. No patch is currently available for this command injection flaw.
Auth bypass in HPE Aruba AOS-CX switch web management.
web-based management interface of AOS-CX Switches is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).
A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ArubaOS-CX web management interface session fixation allows an authenticated remote attacker with low-privilege credentials to hijack an active user session when a legitimate user interacts with the interface, potentially viewing or modifying sensitive switch configuration. The CVSS 7.3 flaw requires reachability to the management UI and victim interaction, with no availability impact; EPSS is low at 0.05% and no public exploit was identified at time of analysis. Environments that expose the web UI to multiple administrators and broad networks have the highest practical exposure.
Authenticated remote attackers holding low-privilege management access to HPE Aruba Networking AOS-CX switches can inject arbitrary OS commands through a management-plane function, resulting in remote code execution with high confidentiality, integrity, and availability impact. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is a credible mid-to-high priority but not an emergency; EPSS is 0.13% (32nd percentile) and no public exploit code was identified at time of analysis. The main exposure is organizations that allow management access from broad networks or grant operator-level accounts more widely than necessary.
Authenticated command injection in HPE ArubaOS-CX allows a remote attacker who already holds valid management credentials to execute arbitrary OS commands, with potential for full Remote Code Execution on the switch. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact, but the mandatory authenticated access and typical management-network segregation reduce exposure. No public exploit was identified at time of analysis, and EPSS is low at 0.13% (32nd percentile).
A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: - AOS-CX 10.14.xxxx : All patches -. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. Rated low severity (CVSS 3.4), this vulnerability is no authentication required. No vendor patch available.
An authenticated command injection vulnerability exists in the AOS-CX command line interface. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.