Fabric Composer
Monthly
Remote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the appliance's SSH daemon over the network and gain administrative access to vulnerable AFC hosts. Once in, the attacker can execute arbitrary commands as a privileged OS user, resulting in complete system compromise. Rated CVSS 10.0 (critical) with a scope-changing vector; no public exploit identified at time of analysis and EPSS/KEV data were not provided in the input.
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent existing authentication controls to gain administrative privileges and completely compromise the Fabric Composer host. HPE rates this CVSS 10.0 (network, low complexity, no privileges, no user interaction, scope-changed). No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Cleartext exposure of sensitive information in HPE Networking Fabric Composer's management interface can be triggered by an authenticated administrator, potentially revealing credentials or configuration data for downstream network services. The vulnerability requires both administrative privileges and high attack complexity (CVSS 2.2, AV:N/AC:H/PR:H), meaning realistic exploitability is limited to insiders or attackers who have already fully compromised an admin account. Successful exploitation could enable lateral movement into network services managed by Fabric Composer. No public exploit code or CISA KEV listing has been identified.
Local privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator with physical or shell access to elevate user privileges and make limited modifications to the affected system. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires both local system access and a low-privilege operator account, and the high attack complexity suggests non-trivial preconditions must be met. Impact is strictly bounded: the CVSS registers no confidentiality or availability impact, only limited integrity modification (I:L), meaning full administrative compromise is not achieved. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial-of-service in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator to interrupt service availability. The flaw requires high-complexity conditions (AV:N/AC:H/PR:L) and produces only limited availability impact, placing it at CVSS 3.1. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in HPE Networking Fabric Composer's web-based management interface can be triggered by an authenticated low-privilege operator, disrupting the availability of the management UI. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) reflects a low-severity, network-accessible flaw requiring valid credentials and user interaction, yielding only limited availability impact. No exploitation has been publicly demonstrated, and the vulnerability does not affect the underlying fabric infrastructure - only the management interface itself.
Unauthenticated remote information disclosure in HPE Networking Fabric Composer exposes cleartext data through the web-based management interface to network-positioned attackers. Exploitation demands high attack complexity (CVSS AC:H), constraining real-world risk despite the network-accessible, no-authentication vector. The vendor advisory identifies remediation; no public exploit code or CISA KEV listing has been identified, though the disclosed data could enable secondary compromise of dependent network infrastructure.
Source address spoofing in HPE Networking Fabric Composer allows an authenticated low-privilege operator to forge the origin address recorded for their API requests, corrupting the audit trail for affected system actions. The attacker cannot read sensitive data or disrupt availability; the sole impact is integrity of attribution records, confirmed by the CVSS vector (C:N/I:L/A:N). No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Authenticated low-privilege information disclosure in HPE Networking Fabric Composer's API permits operator-level users to read system files outside their authorized scope. The CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a bounded, post-authentication flaw with limited confidentiality impact. No public exploit code exists and the vulnerability is not listed in CISA KEV, placing real-world risk at low priority absent privileged insider threat scenarios.
Local privilege escalation in HPE Networking Fabric Composer enables an authenticated, highly privileged operator on the underlying host to elevate their role within the Fabric Composer management hierarchy, gaining access to higher-privileged administrative functions. The impact is bounded to integrity - specifically the ability to alter certain system configuration settings - with no confidentiality or availability consequence reported. No public exploit code and no CISA KEV listing exist at time of analysis, consistent with the low CVSS score of 4.4 and the stringent local, high-privilege prerequisite.
Cleartext exposure of sensitive information in the HPE Networking Fabric Composer API allows a local attacker holding administrative credentials to retrieve secrets that the system is expected to protect in encrypted form. The vulnerability is constrained to local access with high privileges already obtained, yielding a CVSS 3.1 score of 4.4 (Medium). No public exploit code or active exploitation has been identified at time of analysis; the advisory originates from HPE itself, suggesting proactive disclosure rather than incident response.
Local information disclosure in HPE Networking Fabric Composer allows an authenticated low-privileged operator user with local system access to read sensitive OS-level data, potentially enabling privilege escalation on the affected host. The vulnerability resides in the underlying operating system layer exposed through Fabric Composer's operator access model, and is constrained by both a local attack vector and high complexity requirement. No public exploit code has been identified and this entry does not appear in the CISA KEV catalog.
Path traversal in HPE Networking Fabric Composer's API endpoint allows an unauthenticated adjacent attacker to manipulate user-generated files and potentially alter critical system configurations. Exploitation is constrained by the AV:A vector (attacker must be on the same network segment), high attack complexity requiring preconditions outside the attacker's control, and mandatory user interaction - factors that collectively reduce the practical risk below the I:H integrity impact might suggest. No public exploit code has been identified and the vulnerability is not listed in CISA KEV. The CVSS base score of 4.8 reflects these limiting conditions accurately.
Unauthenticated file read in HPE Networking Fabric Composer's web-based management interface exposes a subset of system files to remote attackers without requiring any credentials. The vulnerability is confined to files within a specific affected directory rather than offering arbitrary filesystem access, yielding a limited confidentiality impact consistent with the CVSS 5.3 (C:L) score. No active exploitation (KEV) or public proof-of-concept has been identified at time of analysis, and no EPSS signal is provided in available intelligence.
Authenticated privilege escalation in HPE Networking Fabric Composer's API allows low-privilege operator users to read limited information and make limited configuration changes beyond their authorized scope. The flaw affects all tracked versions per CPE data and requires only a valid low-privilege account to exploit - no special configuration or user interaction is needed. No public exploit code and no CISA KEV listing are present at time of analysis, keeping real-world risk moderate despite network accessibility.
Open redirect in the HPE Networking Fabric Composer web management interface allows unauthenticated remote attackers to craft URLs that transparently forward authenticated users to attacker-controlled destinations. The flaw targets network administrators who interact with the management console, creating a reliable phishing vector for credential harvesting against privileged accounts. No public exploit has been identified at time of analysis, and neither EPSS data nor KEV listing was provided, but the absence of authentication requirements and low attack complexity make opportunistic delivery of crafted links straightforward.
HPE Networking Fabric Composer's API authentication controls can be circumvented by an already-authenticated low-privilege operator, allowing that user to retain access even after administrative revocation. This is an access-persistence flaw rather than an initial-access bypass - a direct insider-threat concern in environments that rely on Fabric Composer's own revocation mechanisms for offboarding or role changes. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Local information disclosure in HPE Networking Fabric Composer exposes sensitive operating-system-level data to authenticated low-privilege operator users with local system access. The CVSS Scope:Changed metric reflects that the leaked data crosses from the Fabric Composer application boundary into the underlying host OS, and HPE warns the recovered information could enable further unauthorized access to the affected system and interconnected infrastructure. No public exploit is identified at time of analysis; exploitation requires both a valid low-privilege credential and local system access, materially constraining the realistic threat population.
Reflected cross-site scripting in the HPE Networking Fabric Composer web management interface allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim administrator's browser by tricking them into following a crafted URL. The CVSS Scope:Changed metric confirms the injected script executes across the browser security boundary, enabling session token theft, credential harvesting, or unauthorized administrative actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated operator-level user to modify system settings that the API is intended to restrict to higher-privilege roles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms network-exploitable with low attack complexity, requiring only a valid operator credential and no user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Sensitive information exposure in HPE Networking Fabric Composer allows an authenticated low-privilege operator user with local access to upstream AFC dependencies to read data outside their authorized scope. The CVSS vector (S:C/C:H) reflects that the confidentiality breach crosses authorization boundaries within the underlying OS layer, not merely within the user's own privilege tier. No public exploit code exists and the vulnerability has not been added to CISA KEV at time of analysis, but the high confidentiality impact and scope change elevate real-world concern for multi-tenant or shared-operator deployments.
Multiple denial-of-service vulnerabilities in the HPE Networking Fabric Composer API allow an authenticated low-privilege operator to disrupt management plane availability. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network-accessible exploitation requiring only standard operator credentials with no additional user interaction. No public exploit code has been identified at time of analysis, and the HPE advisory hpesbnw05133en_us is the sole authoritative source confirming the issue.
Authenticated low-privilege API access in HPE Networking Fabric Composer allows operator-level users to retrieve sensitive data beyond their authorized scope. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H) confirms any valid operator account can exploit this over the network with no user interaction, obtaining high-confidentiality-impact data such as network topology, service credentials, or configuration details. Per the vendor advisory, the exfiltrated data could serve as a pivot to gain further unauthorized access to network services managed by Fabric Composer. No public exploit or CISA KEV listing is present at time of analysis.
Authentication bypass in HPE Networking Fabric Composer exposes enterprise network orchestration environments to unauthenticated administrative takeover by adjacent network actors. The vulnerability resides in the underlying operating system layer of the appliance, allowing an attacker with network adjacency to circumvent authentication controls without credentials, gaining full administrative access. Successful exploitation enables configuration tampering and sensitive data access or manipulation across the orchestration platform. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker holding a low-privileged local account to execute arbitrary code with root privileges, achieving complete host compromise. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation is confined to the local system and requires high attack complexity - consistent with a race condition or SUID-binary class of flaw. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Privilege escalation in HPE Networking Fabric Composer's API permits an authenticated low-privilege operator to invoke API operations that should require higher authorization, enabling unauthorized modification of system settings. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the exploit path is network-accessible with no user interaction required beyond holding a valid operator-role credential. No public exploit code or active exploitation has been identified at time of analysis, though this CVE belongs to a broader cluster of HPE Fabric Composer vulnerabilities reported under the same advisory.
Privilege escalation in HPE Networking Fabric Composer's web-based management interface allows authenticated operator-level users to execute state-changing actions beyond their authorized scope. The CVSS vector (PR:L/I:H) confirms exploitation requires low-privilege credentials but yields high-integrity impact - unauthorized modification of platform state that should be gated to higher-privilege roles. No active exploitation or public exploit code has been identified at time of analysis.
Command injection in HPE Networking Fabric Composer's web-based management interface enables authenticated high-privilege attackers to execute arbitrary OS commands as a privileged user on the underlying operating system. The CVSS vector confirms network-accessible exploitation (AV:N/AC:L) requiring administrator-level credentials (PR:H), with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in CISA KEV; the HPE security bulletin hpesbnw05133en_us is the authoritative source for remediation guidance.
SQL injection vulnerabilities in HPE Networking Fabric Composer's API allow authenticated remote attackers holding high-privilege accounts to read and modify the underlying database, with HPE warning this could escalate to complete compromise of the Fabric Composer host. The CVSS vector (PR:H, AV:N, AC:L) confirms the attack is network-reachable with no special complexity, but requires pre-existing administrative credentials - constraining exposure to insider threats or post-credential-compromise scenarios. No public exploit code and no CISA KEV listing are identified at time of analysis.
Remote code execution in HPE Networking Fabric Composer allows an authenticated attacker with high-privilege API access to execute arbitrary operating system commands as a privileged user on the underlying host. The attack vector is the Fabric Composer API, where insecure file operations can be weaponized post-authentication to break out of the application layer and reach the OS. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 7.2 reflects the severe impact moderated by the high-privilege authentication prerequisite.
Arbitrary file write via the HPE Networking Fabric Composer API enables an authenticated administrative user to escalate privileges to root on the underlying operating system. The vulnerability allows admin-level API users to write attacker-controlled content to arbitrary filesystem paths, which can then be leveraged to execute arbitrary OS commands as root. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Sensitive information disclosure in HPE Networking Fabric Composer's web management interface allows an unauthenticated remote attacker to retrieve network service credentials or configuration data by social-engineering an authenticated administrator into clicking a specially crafted URL. The CVSS scope change (S:C) combined with high confidentiality impact (C:H) indicates that the exfiltrated data can reach beyond the web application itself - potentially exposing credentials or configuration for the fabric services that Fabric Composer orchestrates. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, successful exploitation could serve as an initial foothold for deeper compromise of managed network infrastructure.
Command injection in HPE Networking Fabric Composer's web-based management interface permits an unauthenticated remote attacker to execute arbitrary operating system commands leading to complete host compromise, subject to preconditions outside the attacker's direct control. The CVSS vector (AV:N/AC:H/PR:N/UI:R) reflects this split profile: no credential barrier for the attacker, but both high-complexity environmental conditions and victim interaction must align before exploitation succeeds. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in HPE Networking Fabric Composer exposes organizations to complete host compromise by an unauthenticated remote attacker, provided attacker-independent preconditions and a user-interaction trigger are both satisfied. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) scores 7.5, reflecting full C:H/I:H/A:H impact tempered by high attack complexity and required user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote denial of service in HPE Networking Fabric Composer's API allows a network-adjacent or internet-reachable attacker to disrupt the availability of the management interface with no credentials required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity, fully unauthenticated attack path yielding high availability impact, with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Broken access control in HPE Networking Fabric Composer's API allows authenticated low-privilege operator users to read data beyond their authorized scope, potentially enabling lateral movement or privilege escalation within the management plane. The vulnerability is network-exploitable with low attack complexity once a valid operator credential is obtained, as reflected by the CVSS 7.6 score (AV:N/AC:L/PR:L). No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker with low-level local access to execute arbitrary code with root privileges on the host operating system. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local foothold with minimal privileges - no user interaction or elevated rights needed beyond initial system access. No public exploit code or CISA KEV listing has been identified at time of analysis; however, HPE has published a security bulletin acknowledging the issue.
Unauthenticated remote command execution in HPE Networking Fabric Composer's API allows a network-accessible attacker to run arbitrary commands on the underlying operating system, resulting in complete host compromise. Exploitation requires certain preconditions outside the attacker's control (reflected in AC:H), but no authentication is needed once those conditions are satisfied. No public exploit has been identified at time of analysis; HPE has published a security bulletin addressing the issue.
Privilege escalation via an unauthenticated API endpoint in HPE Networking Fabric Composer allows a remote attacker to obtain administrative privileges and achieve complete compromise of the Fabric Composer host. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exploitation, though AC:H indicates a non-trivial exploitation condition such as a race, specific request sequence, or transient configuration state. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Unauthenticated remote exploitation of an API endpoint in HPE Networking Fabric Composer can cause high-impact denial of service requiring manual administrator intervention, along with limited unauthorized modifications to the underlying operating system. The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) confirms no authentication, no special conditions, and network-level accessibility with no user interaction required. No public exploit code or active exploitation is confirmed at time of analysis, but the management-plane targeting makes this a remediation priority for organizations running HPE fabric orchestration infrastructure.
Arbitrary OS command execution in HPE Networking Fabric Composer allows an unauthenticated attacker on an adjacent network segment to run arbitrary commands on the underlying host, achieving full system compromise. Exploitation depends on preconditions outside the attacker's direct control, which constrains practical risk and drives the AC:H rating despite the severity of the impact. No public exploit or active exploitation has been identified at time of analysis; HPE has published a security bulletin (hpesbnw05133en_us) addressing this issue.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit business logic flaws in the product API, obtaining elevated privileges and modifying system settings beyond their authorized scope. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:L/UI:N) reflects that exploitation is network-accessible, low-complexity, and requires only a valid operator credential. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invoke state-changing API operations beyond their authorized scope, including modifications to configurations of network systems managed by the platform. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/I:H) confirms the flaw is remotely exploitable with no complexity or interaction requirements, and that the integrity impact extends beyond Fabric Composer itself to the downstream network infrastructure it manages. No public exploit code or CISA KEV listing is present at time of analysis, but the low exploitation barrier - a valid low-privilege credential - makes this a meaningful insider and credential-theft escalation risk.
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system information and make unauthorized changes to certain configuration settings, potentially disrupting fabric management operations. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and the 'Authentication Bypass' tag confirm that no credentials are required for network-based exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escalate privileges and execute arbitrary commands on the underlying operating system, resulting in complete system compromise. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-exploitable, low-complexity exploitation requiring only a valid operator account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the clear privilege escalation path from a low-privilege role to OS-level access makes this a high-priority remediation target in any Fabric Composer deployment.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full administrative control via a command sanitization bypass in the product API. Exploitation is network-accessible with low complexity and no user interaction required, yielding complete confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, and CISA has not listed this CVE in the Known Exploited Vulnerabilities catalog.
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated attacker on an adjacent network segment to inject persistent malicious script into the interface, which executes in any authenticated user's browser upon visiting the affected page. The CVSS 8.8 score with S:C/C:H/I:H/A:H reflects the elevated downstream impact: a successful payload executing in a network administrator's session could facilitate full session hijacking, credential theft, or unauthorized configuration changes to the managed fabric infrastructure. No public exploit or KEV listing has been identified at time of analysis.
Unauthenticated information disclosure in HPE Networking Fabric Composer's API endpoint exposes internal service and workflow details to remote attackers under high-complexity conditions. The vulnerability requires user interaction per the CVSS vector (UI:R), which is atypical for an API endpoint flaw, suggesting a specific trigger mechanism or chained condition not fully described in the advisory. Impact is limited to low confidentiality exposure, though HPE's own advisory frames it as a stepping stone that increases risk when chained with other vulnerabilities. No public exploit or KEV listing identified at time of analysis.
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elevate permissions to administrative level, resulting in complete system compromise. The flaw is exploitable over the network without user interaction, making it accessible to any attacker holding a valid operator account. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes this a credible internal-threat vector in any environment where operator credentials are broadly issued or have been exposed.
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code as a privileged user on the appliance's underlying operating system, resulting in complete host compromise. HPE notes exploitation depends on 'certain preconditions outside of the attacker's control,' which is reflected in the CVSS high attack complexity (AC:H). No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV.
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated low-privilege operator to inject persistent script that executes in an administrator's browser session, enabling privilege escalation within the appliance interface. HPE (advisory hpesbnw05133) assigned a CVSS 3.1 base score of 9.0, driven largely by a scope change (S:C) and full C/I/A impact against the higher-privileged admin context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network execute arbitrary code as a privileged user on the underlying operating system, resulting in complete compromise of the AFC host. The flaw carries a CVSS 9.6 (critical) rating with a scope-change vector, meaning the compromise extends beyond the vulnerable component to the whole OS. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the appliance's SSH daemon over the network and gain administrative access to vulnerable AFC hosts. Once in, the attacker can execute arbitrary commands as a privileged OS user, resulting in complete system compromise. Rated CVSS 10.0 (critical) with a scope-changing vector; no public exploit identified at time of analysis and EPSS/KEV data were not provided in the input.
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent existing authentication controls to gain administrative privileges and completely compromise the Fabric Composer host. HPE rates this CVSS 10.0 (network, low complexity, no privileges, no user interaction, scope-changed). No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Cleartext exposure of sensitive information in HPE Networking Fabric Composer's management interface can be triggered by an authenticated administrator, potentially revealing credentials or configuration data for downstream network services. The vulnerability requires both administrative privileges and high attack complexity (CVSS 2.2, AV:N/AC:H/PR:H), meaning realistic exploitability is limited to insiders or attackers who have already fully compromised an admin account. Successful exploitation could enable lateral movement into network services managed by Fabric Composer. No public exploit code or CISA KEV listing has been identified.
Local privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator with physical or shell access to elevate user privileges and make limited modifications to the affected system. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires both local system access and a low-privilege operator account, and the high attack complexity suggests non-trivial preconditions must be met. Impact is strictly bounded: the CVSS registers no confidentiality or availability impact, only limited integrity modification (I:L), meaning full administrative compromise is not achieved. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial-of-service in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator to interrupt service availability. The flaw requires high-complexity conditions (AV:N/AC:H/PR:L) and produces only limited availability impact, placing it at CVSS 3.1. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in HPE Networking Fabric Composer's web-based management interface can be triggered by an authenticated low-privilege operator, disrupting the availability of the management UI. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) reflects a low-severity, network-accessible flaw requiring valid credentials and user interaction, yielding only limited availability impact. No exploitation has been publicly demonstrated, and the vulnerability does not affect the underlying fabric infrastructure - only the management interface itself.
Unauthenticated remote information disclosure in HPE Networking Fabric Composer exposes cleartext data through the web-based management interface to network-positioned attackers. Exploitation demands high attack complexity (CVSS AC:H), constraining real-world risk despite the network-accessible, no-authentication vector. The vendor advisory identifies remediation; no public exploit code or CISA KEV listing has been identified, though the disclosed data could enable secondary compromise of dependent network infrastructure.
Source address spoofing in HPE Networking Fabric Composer allows an authenticated low-privilege operator to forge the origin address recorded for their API requests, corrupting the audit trail for affected system actions. The attacker cannot read sensitive data or disrupt availability; the sole impact is integrity of attribution records, confirmed by the CVSS vector (C:N/I:L/A:N). No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Authenticated low-privilege information disclosure in HPE Networking Fabric Composer's API permits operator-level users to read system files outside their authorized scope. The CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a bounded, post-authentication flaw with limited confidentiality impact. No public exploit code exists and the vulnerability is not listed in CISA KEV, placing real-world risk at low priority absent privileged insider threat scenarios.
Local privilege escalation in HPE Networking Fabric Composer enables an authenticated, highly privileged operator on the underlying host to elevate their role within the Fabric Composer management hierarchy, gaining access to higher-privileged administrative functions. The impact is bounded to integrity - specifically the ability to alter certain system configuration settings - with no confidentiality or availability consequence reported. No public exploit code and no CISA KEV listing exist at time of analysis, consistent with the low CVSS score of 4.4 and the stringent local, high-privilege prerequisite.
Cleartext exposure of sensitive information in the HPE Networking Fabric Composer API allows a local attacker holding administrative credentials to retrieve secrets that the system is expected to protect in encrypted form. The vulnerability is constrained to local access with high privileges already obtained, yielding a CVSS 3.1 score of 4.4 (Medium). No public exploit code or active exploitation has been identified at time of analysis; the advisory originates from HPE itself, suggesting proactive disclosure rather than incident response.
Local information disclosure in HPE Networking Fabric Composer allows an authenticated low-privileged operator user with local system access to read sensitive OS-level data, potentially enabling privilege escalation on the affected host. The vulnerability resides in the underlying operating system layer exposed through Fabric Composer's operator access model, and is constrained by both a local attack vector and high complexity requirement. No public exploit code has been identified and this entry does not appear in the CISA KEV catalog.
Path traversal in HPE Networking Fabric Composer's API endpoint allows an unauthenticated adjacent attacker to manipulate user-generated files and potentially alter critical system configurations. Exploitation is constrained by the AV:A vector (attacker must be on the same network segment), high attack complexity requiring preconditions outside the attacker's control, and mandatory user interaction - factors that collectively reduce the practical risk below the I:H integrity impact might suggest. No public exploit code has been identified and the vulnerability is not listed in CISA KEV. The CVSS base score of 4.8 reflects these limiting conditions accurately.
Unauthenticated file read in HPE Networking Fabric Composer's web-based management interface exposes a subset of system files to remote attackers without requiring any credentials. The vulnerability is confined to files within a specific affected directory rather than offering arbitrary filesystem access, yielding a limited confidentiality impact consistent with the CVSS 5.3 (C:L) score. No active exploitation (KEV) or public proof-of-concept has been identified at time of analysis, and no EPSS signal is provided in available intelligence.
Authenticated privilege escalation in HPE Networking Fabric Composer's API allows low-privilege operator users to read limited information and make limited configuration changes beyond their authorized scope. The flaw affects all tracked versions per CPE data and requires only a valid low-privilege account to exploit - no special configuration or user interaction is needed. No public exploit code and no CISA KEV listing are present at time of analysis, keeping real-world risk moderate despite network accessibility.
Open redirect in the HPE Networking Fabric Composer web management interface allows unauthenticated remote attackers to craft URLs that transparently forward authenticated users to attacker-controlled destinations. The flaw targets network administrators who interact with the management console, creating a reliable phishing vector for credential harvesting against privileged accounts. No public exploit has been identified at time of analysis, and neither EPSS data nor KEV listing was provided, but the absence of authentication requirements and low attack complexity make opportunistic delivery of crafted links straightforward.
HPE Networking Fabric Composer's API authentication controls can be circumvented by an already-authenticated low-privilege operator, allowing that user to retain access even after administrative revocation. This is an access-persistence flaw rather than an initial-access bypass - a direct insider-threat concern in environments that rely on Fabric Composer's own revocation mechanisms for offboarding or role changes. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Local information disclosure in HPE Networking Fabric Composer exposes sensitive operating-system-level data to authenticated low-privilege operator users with local system access. The CVSS Scope:Changed metric reflects that the leaked data crosses from the Fabric Composer application boundary into the underlying host OS, and HPE warns the recovered information could enable further unauthorized access to the affected system and interconnected infrastructure. No public exploit is identified at time of analysis; exploitation requires both a valid low-privilege credential and local system access, materially constraining the realistic threat population.
Reflected cross-site scripting in the HPE Networking Fabric Composer web management interface allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim administrator's browser by tricking them into following a crafted URL. The CVSS Scope:Changed metric confirms the injected script executes across the browser security boundary, enabling session token theft, credential harvesting, or unauthorized administrative actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated operator-level user to modify system settings that the API is intended to restrict to higher-privilege roles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms network-exploitable with low attack complexity, requiring only a valid operator credential and no user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Sensitive information exposure in HPE Networking Fabric Composer allows an authenticated low-privilege operator user with local access to upstream AFC dependencies to read data outside their authorized scope. The CVSS vector (S:C/C:H) reflects that the confidentiality breach crosses authorization boundaries within the underlying OS layer, not merely within the user's own privilege tier. No public exploit code exists and the vulnerability has not been added to CISA KEV at time of analysis, but the high confidentiality impact and scope change elevate real-world concern for multi-tenant or shared-operator deployments.
Multiple denial-of-service vulnerabilities in the HPE Networking Fabric Composer API allow an authenticated low-privilege operator to disrupt management plane availability. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network-accessible exploitation requiring only standard operator credentials with no additional user interaction. No public exploit code has been identified at time of analysis, and the HPE advisory hpesbnw05133en_us is the sole authoritative source confirming the issue.
Authenticated low-privilege API access in HPE Networking Fabric Composer allows operator-level users to retrieve sensitive data beyond their authorized scope. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H) confirms any valid operator account can exploit this over the network with no user interaction, obtaining high-confidentiality-impact data such as network topology, service credentials, or configuration details. Per the vendor advisory, the exfiltrated data could serve as a pivot to gain further unauthorized access to network services managed by Fabric Composer. No public exploit or CISA KEV listing is present at time of analysis.
Authentication bypass in HPE Networking Fabric Composer exposes enterprise network orchestration environments to unauthenticated administrative takeover by adjacent network actors. The vulnerability resides in the underlying operating system layer of the appliance, allowing an attacker with network adjacency to circumvent authentication controls without credentials, gaining full administrative access. Successful exploitation enables configuration tampering and sensitive data access or manipulation across the orchestration platform. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker holding a low-privileged local account to execute arbitrary code with root privileges, achieving complete host compromise. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation is confined to the local system and requires high attack complexity - consistent with a race condition or SUID-binary class of flaw. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Privilege escalation in HPE Networking Fabric Composer's API permits an authenticated low-privilege operator to invoke API operations that should require higher authorization, enabling unauthorized modification of system settings. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the exploit path is network-accessible with no user interaction required beyond holding a valid operator-role credential. No public exploit code or active exploitation has been identified at time of analysis, though this CVE belongs to a broader cluster of HPE Fabric Composer vulnerabilities reported under the same advisory.
Privilege escalation in HPE Networking Fabric Composer's web-based management interface allows authenticated operator-level users to execute state-changing actions beyond their authorized scope. The CVSS vector (PR:L/I:H) confirms exploitation requires low-privilege credentials but yields high-integrity impact - unauthorized modification of platform state that should be gated to higher-privilege roles. No active exploitation or public exploit code has been identified at time of analysis.
Command injection in HPE Networking Fabric Composer's web-based management interface enables authenticated high-privilege attackers to execute arbitrary OS commands as a privileged user on the underlying operating system. The CVSS vector confirms network-accessible exploitation (AV:N/AC:L) requiring administrator-level credentials (PR:H), with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in CISA KEV; the HPE security bulletin hpesbnw05133en_us is the authoritative source for remediation guidance.
SQL injection vulnerabilities in HPE Networking Fabric Composer's API allow authenticated remote attackers holding high-privilege accounts to read and modify the underlying database, with HPE warning this could escalate to complete compromise of the Fabric Composer host. The CVSS vector (PR:H, AV:N, AC:L) confirms the attack is network-reachable with no special complexity, but requires pre-existing administrative credentials - constraining exposure to insider threats or post-credential-compromise scenarios. No public exploit code and no CISA KEV listing are identified at time of analysis.
Remote code execution in HPE Networking Fabric Composer allows an authenticated attacker with high-privilege API access to execute arbitrary operating system commands as a privileged user on the underlying host. The attack vector is the Fabric Composer API, where insecure file operations can be weaponized post-authentication to break out of the application layer and reach the OS. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 7.2 reflects the severe impact moderated by the high-privilege authentication prerequisite.
Arbitrary file write via the HPE Networking Fabric Composer API enables an authenticated administrative user to escalate privileges to root on the underlying operating system. The vulnerability allows admin-level API users to write attacker-controlled content to arbitrary filesystem paths, which can then be leveraged to execute arbitrary OS commands as root. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Sensitive information disclosure in HPE Networking Fabric Composer's web management interface allows an unauthenticated remote attacker to retrieve network service credentials or configuration data by social-engineering an authenticated administrator into clicking a specially crafted URL. The CVSS scope change (S:C) combined with high confidentiality impact (C:H) indicates that the exfiltrated data can reach beyond the web application itself - potentially exposing credentials or configuration for the fabric services that Fabric Composer orchestrates. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, successful exploitation could serve as an initial foothold for deeper compromise of managed network infrastructure.
Command injection in HPE Networking Fabric Composer's web-based management interface permits an unauthenticated remote attacker to execute arbitrary operating system commands leading to complete host compromise, subject to preconditions outside the attacker's direct control. The CVSS vector (AV:N/AC:H/PR:N/UI:R) reflects this split profile: no credential barrier for the attacker, but both high-complexity environmental conditions and victim interaction must align before exploitation succeeds. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in HPE Networking Fabric Composer exposes organizations to complete host compromise by an unauthenticated remote attacker, provided attacker-independent preconditions and a user-interaction trigger are both satisfied. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) scores 7.5, reflecting full C:H/I:H/A:H impact tempered by high attack complexity and required user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote denial of service in HPE Networking Fabric Composer's API allows a network-adjacent or internet-reachable attacker to disrupt the availability of the management interface with no credentials required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity, fully unauthenticated attack path yielding high availability impact, with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Broken access control in HPE Networking Fabric Composer's API allows authenticated low-privilege operator users to read data beyond their authorized scope, potentially enabling lateral movement or privilege escalation within the management plane. The vulnerability is network-exploitable with low attack complexity once a valid operator credential is obtained, as reflected by the CVSS 7.6 score (AV:N/AC:L/PR:L). No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker with low-level local access to execute arbitrary code with root privileges on the host operating system. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local foothold with minimal privileges - no user interaction or elevated rights needed beyond initial system access. No public exploit code or CISA KEV listing has been identified at time of analysis; however, HPE has published a security bulletin acknowledging the issue.
Unauthenticated remote command execution in HPE Networking Fabric Composer's API allows a network-accessible attacker to run arbitrary commands on the underlying operating system, resulting in complete host compromise. Exploitation requires certain preconditions outside the attacker's control (reflected in AC:H), but no authentication is needed once those conditions are satisfied. No public exploit has been identified at time of analysis; HPE has published a security bulletin addressing the issue.
Privilege escalation via an unauthenticated API endpoint in HPE Networking Fabric Composer allows a remote attacker to obtain administrative privileges and achieve complete compromise of the Fabric Composer host. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exploitation, though AC:H indicates a non-trivial exploitation condition such as a race, specific request sequence, or transient configuration state. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Unauthenticated remote exploitation of an API endpoint in HPE Networking Fabric Composer can cause high-impact denial of service requiring manual administrator intervention, along with limited unauthorized modifications to the underlying operating system. The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) confirms no authentication, no special conditions, and network-level accessibility with no user interaction required. No public exploit code or active exploitation is confirmed at time of analysis, but the management-plane targeting makes this a remediation priority for organizations running HPE fabric orchestration infrastructure.
Arbitrary OS command execution in HPE Networking Fabric Composer allows an unauthenticated attacker on an adjacent network segment to run arbitrary commands on the underlying host, achieving full system compromise. Exploitation depends on preconditions outside the attacker's direct control, which constrains practical risk and drives the AC:H rating despite the severity of the impact. No public exploit or active exploitation has been identified at time of analysis; HPE has published a security bulletin (hpesbnw05133en_us) addressing this issue.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit business logic flaws in the product API, obtaining elevated privileges and modifying system settings beyond their authorized scope. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:L/UI:N) reflects that exploitation is network-accessible, low-complexity, and requires only a valid operator credential. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invoke state-changing API operations beyond their authorized scope, including modifications to configurations of network systems managed by the platform. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/I:H) confirms the flaw is remotely exploitable with no complexity or interaction requirements, and that the integrity impact extends beyond Fabric Composer itself to the downstream network infrastructure it manages. No public exploit code or CISA KEV listing is present at time of analysis, but the low exploitation barrier - a valid low-privilege credential - makes this a meaningful insider and credential-theft escalation risk.
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system information and make unauthorized changes to certain configuration settings, potentially disrupting fabric management operations. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and the 'Authentication Bypass' tag confirm that no credentials are required for network-based exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escalate privileges and execute arbitrary commands on the underlying operating system, resulting in complete system compromise. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-exploitable, low-complexity exploitation requiring only a valid operator account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the clear privilege escalation path from a low-privilege role to OS-level access makes this a high-priority remediation target in any Fabric Composer deployment.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full administrative control via a command sanitization bypass in the product API. Exploitation is network-accessible with low complexity and no user interaction required, yielding complete confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, and CISA has not listed this CVE in the Known Exploited Vulnerabilities catalog.
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated attacker on an adjacent network segment to inject persistent malicious script into the interface, which executes in any authenticated user's browser upon visiting the affected page. The CVSS 8.8 score with S:C/C:H/I:H/A:H reflects the elevated downstream impact: a successful payload executing in a network administrator's session could facilitate full session hijacking, credential theft, or unauthorized configuration changes to the managed fabric infrastructure. No public exploit or KEV listing has been identified at time of analysis.
Unauthenticated information disclosure in HPE Networking Fabric Composer's API endpoint exposes internal service and workflow details to remote attackers under high-complexity conditions. The vulnerability requires user interaction per the CVSS vector (UI:R), which is atypical for an API endpoint flaw, suggesting a specific trigger mechanism or chained condition not fully described in the advisory. Impact is limited to low confidentiality exposure, though HPE's own advisory frames it as a stepping stone that increases risk when chained with other vulnerabilities. No public exploit or KEV listing identified at time of analysis.
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elevate permissions to administrative level, resulting in complete system compromise. The flaw is exploitable over the network without user interaction, making it accessible to any attacker holding a valid operator account. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes this a credible internal-threat vector in any environment where operator credentials are broadly issued or have been exposed.
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code as a privileged user on the appliance's underlying operating system, resulting in complete host compromise. HPE notes exploitation depends on 'certain preconditions outside of the attacker's control,' which is reflected in the CVSS high attack complexity (AC:H). No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV.
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated low-privilege operator to inject persistent script that executes in an administrator's browser session, enabling privilege escalation within the appliance interface. HPE (advisory hpesbnw05133) assigned a CVSS 3.1 base score of 9.0, driven largely by a scope change (S:C) and full C/I/A impact against the higher-privileged admin context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network execute arbitrary code as a privileged user on the underlying operating system, resulting in complete compromise of the AFC host. The flaw carries a CVSS 9.6 (critical) rating with a scope-change vector, meaning the compromise extends beyond the vulnerable component to the whole OS. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.