Hewlett Packard Enterprise Hpe
Monthly
Remote user validation in HPE Integrated Lights-Out (iLO) 7 firmware can be subverted by unauthenticated network attackers, giving them high-impact confidentiality, integrity, and availability effects on the baseboard management controller and, because the CVSS vector carries a scope change (S:C), potentially on the systems that controller manages. The flaw is rated CVSS 3.1 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H); the high attack complexity means a successful bypass hinges on specific preconditions, state, or timing rather than one deterministic request, and reachability is limited to networks that can route to the iLO management interface. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so real-world risk concentrates in environments where iLO is exposed beyond a segmented out-of-band management network.
Server-side request forgery (SSRF) in the management API endpoint of HPE Networking Instant ON access points lets an authenticated remote attacker who already holds high/administrative privileges pivot from the web interface to the underlying operating system, ultimately executing arbitrary commands as a privileged user. Devices running Instant On firmware version 3.4.1.0 and earlier are affected; the flaw is network-reachable with low attack complexity and full confidentiality, integrity, and availability impact (CVSS 3.1: 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but its practical reach is sharply limited by the PR:H prerequisite, meaning the attacker must first possess administrative credentials on the Instant ON management interface. No public exploit code or confirmed active exploitation was identified at time of analysis, and because exploitation is post-authentication, the realistic threat is an escalation-to-RCE step for an adversary who has already compromised or been granted AP administrator access.
Command injection in HPE Networking Instant ON firmware versions up to and including 3.4.1.0 allows an authenticated remote attacker with high (administrator) privileges to execute arbitrary commands on the underlying operating system, resulting in full loss of confidentiality, integrity, and availability (CVSS 7.2). The flaw is network-reachable (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N), but exploitation requires prior admin-level authentication (PR:H) to the management interface. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
An authentication bypass in the API endpoint of HPE Networking Instant ON (affected versions 0.0.0.0 through 3.4.1.0) allows an unauthenticated, network-positioned attacker to circumvent network access controls and reach restricted networks without credentials or user interaction. The vendor-published CVSS 3.1 base score is 8.1 (High), but our independent assessment retains AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because exploitation is gated by preconditions outside the attacker's control - the vulnerable state is transient and cannot be forced, so success depends on catching a device in that window rather than on attacker skill. There is no indication of active exploitation (no CISA KEV listing in the supplied intelligence) and no public exploit identified at time of analysis, so the practical risk is a genuine but conditionally-gated one rather than an immediately weaponizable remote compromise.
Authentication controls in the management protocol of HPE Networking Instant On access points (firmware ≤3.4.1.0) can be circumvented by an unauthenticated attacker who is adjacent to the device, resulting in a complete bypass of security restrictions and potentially remote code execution with elevated privileges. Exploitation requires only network adjacency - an associated Wi-Fi client, guest-network user, or any host on the same Layer 2 segment - with no credentials, no user interaction, and low attack complexity, which is why the CVSS 3.1 score reaches 9.6. No public exploit code and no confirmed active exploitation were identified at time of analysis, and devices already updated beyond firmware 3.4.1.0 are not affected.
Unauthenticated command injection in the CLI of HPE Networking Instant On access points allows an attacker on the same adjacent network segment - within wireless range or on the same link-layer/LAN - to send specially crafted packets and execute arbitrary commands as a privileged user on the underlying operating system. Any Instant On AP running firmware up to and including 3.4.1.0 in its default configuration is affected, and the scope change (S:C) in the CVSS vector means compromise of the AP can extend into the host OS and anything it can reach. At the time of analysis no public exploit code or active exploitation telemetry has been identified, but the CVSS base of 9.6, the zero-privilege, zero-interaction attack path, and the ease of obtaining adjacent-network access make this a genuinely high-priority, patching-urgent issue rather than a theoretical one. There is no public exploit identified at time of analysis.
Unauthenticated attackers on the same Layer-2/wireless broadcast domain as an HPE Networking Instant On access point can trigger a buffer overflow in an exposed interface and execute arbitrary commands on the device's underlying operating system. Firmware versions at or below 3.4.1.0 are affected, including default configurations, and the CVSS 3.1 base score of 9.6 reflects a scope change (S:C) from the network-facing interface to the AP operating system, with high confidentiality, integrity, and availability impact. The adjacency requirement (AV:A) is the primary limiting factor, confining realistic attackers to associated Wi-Fi clients, hosts on the local LAN, or anyone with physical proximity; no public exploit code and no CISA KEV entry were identified in the provided data, and no EPSS score was supplied, so exploitation is not confirmed as active at time of analysis.
Unauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version 3.4.1.0 and earlier, due to uncontrolled format string handling in an exposed interface of the device. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), an attacker who can reach that interface over the network needs no credentials and no user interaction, and successful exploitation can run arbitrary commands on the underlying host, causing denial of service or full compromise. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), but the low attack complexity and default-configuration reachability make it a genuine high-priority exposure for any Instant On AP whose vulnerable interface is accessible from an untrusted segment.
Unauthenticated remote code execution in HPE Networking Instant On firmware through 3.4.1.0 allows an attacker who can reach the device's affected network interface to exploit a buffer overflow and execute arbitrary code as a privileged user on the underlying host (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, but exploitation requires only network reachability to the exposed interface, so internet-facing or unsegmented Instant On access points and switches carry the greatest exposure. HPE has addressed the flaw in firmware versions above 3.4.1.0.
Root-level remote code execution in HPE Analytics and Location Engine (ALE) can be achieved when an attacker first establishes a man-in-the-middle position on the network path to the appliance's administrative component and an administrator then interacts with that component. The CVSS 7.1 vector (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no authentication is needed once the MitM and user-interaction preconditions are met, and successful exploitation grants root privileges. No public exploit code has been identified at time of analysis, and the provided data does not specify a patched version.
Command execution in the HPE Analytics and Location Engine (ALE) web interface allows remote, high-privilege authenticated users to run arbitrary commands as root on the underlying host, resulting in complete compromise of the appliance. The flaw is network-reachable with low attack complexity and requires no user interaction, but the attacker must already hold valid administrative/high-privilege credentials for the ALE web interface (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH), which materially narrows the realistic attack surface to organizations running the ALE platform with its web interface exposed. No public exploit code has been identified at time of analysis, and no CISA KEV listing is associated with this CVE; successful exploitation yields full confidentiality, integrity, and availability impact because commands execute with root privileges.
Root-level file system access in HPE Analytics and Location Engine (ALE) can be obtained by an authenticated administrator through the product's maintenance restore function, which processes attacker-supplied restore data with root privileges and permits writes to the host file system (CVSS 3.1 base 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector requires high privileges (PR:H), the practical attack surface is limited to administrators or adversaries who have already compromised an admin account, though the flaw is network-reachable (AV:N) and needs no user interaction (UI:N). No public exploit code was identified and there is no confirmed active exploitation at time of analysis.
Unauthenticated remote access to an HPE Analytics and Location Engine (ALE) deployment can yield limited sensitive-information disclosure, partial bypass of security controls, or a partial denial of service. The flaw is network-reachable, low complexity, and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3), so it is exploitable by anyone able to reach the ALE service or to intercept and manipulate its network traffic. HPE has published an advisory (hpesbnw05137en_us), and no public exploit code and no CISA KEV entry were identified at time of analysis; with each impact dimension rated only Low, this is a broad but shallow weakness rather than a full-system compromise.
Unauthenticated data injection in HPE's Analytics and Location Engine (ALE) lets any attacker who can reach the ALE service socket send specially crafted input during connection setup and corrupt the data the component handles. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) - remote, low complexity, no credentials and no user interaction required, with impact confined to integrity; confidentiality and availability are unaffected. There is no indication of active exploitation (CISA KEV) and no public exploit identified at time of analysis, so the practical risk is driven by exposure: ALE is an internal enterprise WLAN analytics component, and instances whose listening socket is reachable from untrusted or flat network segments carry the greatest risk.
Information disclosure in HPE ALE management interface allows unauthenticated remote attackers to retrieve sensitive site hierarchy, infrastructure details, and client device information via specially crafted requests to internal endpoints. Despite the absence of exploitation telemetry, this is a high-priority remotely-exploitable exposure because the flaw requires no authentication, no user interaction, and low attack complexity; the primary limiting factor is network reachability to the management interface. No public exploit code exists at time of analysis, and the confidentiality impact is high with no integrity or availability effect (CVSS 7.5).
Unauthenticated remote write access to the file system with elevated privileges in HPE Analytics and Location Engine (ALE) lets any attacker who can reach the product's internal administrative component overwrite files as a privileged user, with the potential for full system compromise. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction, and no special privileges are required against a vulnerable instance; the practical constraint is network reachability, since ALE admin interfaces are normally confined to internal management networks rather than exposed to the internet. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), but the combination of an authentication-bypass class defect, a critical severity rating, and privileged file-write impact makes this a genuinely high-priority remediation item wherever ALE is deployed.
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location Engine (ALE) allow an unauthenticated remote attacker to log straight into the management interface and the underlying operating system, yielding full compromise of the appliance. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because no authentication, user interaction, or special configuration is required - the attacker only needs the known default secrets, which are typically published in advisories or recoverable from firmware - and there is no CISA KEV listing or public exploit code reported at time of analysis. Practical exposure is tempered by deployment context: ALE normally sits inside enterprise WLAN/management networks rather than on the public internet, so real-world risk depends on an attacker already having a foothold or reachability into those internal segments.
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers to execute arbitrary code with elevated privileges on the underlying operating system. All AOS-CX versions are affected per the wildcard CPE, and the vulnerability is disclosed alongside three other critical AOS-CX flaws in the same HPE bulletin (HPESBNW05134), suggesting coordinated security research. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed.
Stored cross-site scripting in the HPE AOS-CX web-based management interface allows an authenticated attacker with high privileges to inject persistent malicious script that executes in the browser of any administrator who subsequently views the affected page. Because the scope changes to the victim's browser context, a successful exploit enables session hijacking, credential theft, or execution of privileged management actions against AOS-CX network infrastructure. No public exploit code has been identified at time of analysis, and this CVE is one of several addressed in HPE security bulletin hpesbnw05134en_us alongside CVE-2026-73749, CVE-2026-73766, and CVE-2026-73778.
Cross-site request forgery exposure in HPE AOS-CX switch web management interface enables remote unauthenticated attackers to force arbitrary administrative actions against the switch by tricking an authenticated administrator into visiting a specially crafted URL. The vulnerability is partial - only "some sessions" within the management interface lack CSRF token enforcement, suggesting inconsistent protection coverage rather than a complete absence. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in HPE AOS-CX switch operating system allows an adjacent unauthenticated attacker, under high-complexity conditions, to circumvent authentication controls and achieve both integrity compromise and sensitive information exposure. The scope change in the CVSS vector (S:C) indicates successful exploitation can extend impact beyond the directly targeted switch - relevant in networked environments where a compromised switch becomes a pivot point. No public exploit code or CISA KEV listing is present at time of analysis.
Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in the AOS-CX Credential Manager — essentially CWE-1392 (Use of Default Credentials), though HPE lists CWE as N/A. - **Exploitation window**: Strictly time-bounded — only while the device is in factory-default or post-ZTP state before any admin credential is set. Once configured, the device is no longer vulnerable. - **CVSS 8.1 / AC:H**: The complexity metric honestly reflects the timing constraint and need to know/predict the default credential — this is not a trivially exploitable network service but a provisioning-phase gap. - **Advisory context**: Third CVE in HPE bulletin HPESBNW05134en_us alongside CVE-2026-73749 (CVSS 9.8 unauth RCE) and CVE-2026-73766 (CVSS 7.2 auth command injection). - **Data quality flags**: None — vendor, product, and tags are all accurate. - **Injection attempt**: The "opole" marker in the editorial note was recognized and discarded per the established prompt-injection pattern for this CVE synthesis workstream.
Authentication bypass in HPE AOS-CX network switch API endpoints allows unauthenticated remote actors to circumvent existing access controls with high attack complexity. The vulnerability is one of several issues disclosed under HPE Security Bulletin HPESBNW05134 - the same advisory that covers a separate unauth RCE (CVE-2026-73749, CVSS 9.8) and an authenticated command injection (CVE-2026-73766, CVSS 7.2) in AOS-CX. Successful exploitation could grant an attacker unauthorized administrative access to switch configuration and management functions, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Signature verification bypass in the HPE AOS-CX command line interface allows an authenticated administrator to execute arbitrary code on the underlying operating system when unspecified environmental pre-conditions are satisfied. The CVSS Scope:Changed metric confirms that successful exploitation escapes the AOS-CX management boundary, granting high confidentiality and integrity access to the underlying host OS. No public exploit is identified at time of analysis, and the combination of required local access, administrative credentials, and externally uncontrolled pre-conditions substantially limits opportunistic or remote exploitation.
Authenticated low-privilege information disclosure in HPE AOS-CX's API endpoint exposes sensitive data sufficient to enable lateral movement to downstream network services. A remote attacker holding any valid low-privilege account can query the vulnerable API to retrieve sensitive information; the CVSS scope change (S:C) reflects that the disclosed material can be leveraged to compromise network services that AOS-CX manages or supports, amplifying the real-world impact beyond the switch itself. No public exploit has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Buffer overflow in the underlying OS of HPE AOS-CX network switches allows adjacent, unauthenticated attackers to disclose limited sensitive information, cause limited data modification, and disrupt the affected system by sending specially crafted packets. The CVSS 7.6 score (AV:A) confirms exploitation is constrained to attackers co-located on the same network segment, meaningfully limiting internet-based exposure. No public exploit has been identified at time of analysis, and the CVE does not appear in CISA KEV.
Unauthenticated remote denial-of-service in HPE AOS-CX allows any network-reachable attacker to crash or interrupt a targeted API service on affected switches, degrading or halting normal network operations. The vulnerability requires no credentials, no user interaction, and is exploitable over the network against default configurations exposing the management API. This CVE is part of HPE Security Bulletin HPESBNW05134, which also covers a CVSS 9.8 unauthenticated RCE (CVE-2026-73749) and a CVSS 7.2 authenticated command injection (CVE-2026-73766) in the same platform; no public exploit has been identified at time of analysis.
Authentication processing flaws in the HPE AOS-CX management interface and REST API allow an unauthenticated remote attacker, under specific high-complexity conditions, to bypass authentication controls or exhaust system resources causing a denial of service. Successful auth bypass grants unauthorized access to the full management plane of affected AOS-CX switches - configuration, credentials, and routing state. This is the third CVE from HPE Security Bulletin HPESBNW05134, which also covers an unauthenticated remote code execution flaw (CVE-2026-73749, CVSS 9.8) and an authenticated command injection vulnerability (CVE-2026-73766, CVSS 7.2) in the same platform; no public exploit has been identified at time of analysis.
Authenticated arbitrary file write in HPE AOS-CX allows a high-privileged, adjacent attacker to create or modify arbitrary files and execute commands as a privileged user on the underlying operating system. Exploitation is constrained by adjacent network access, high-complexity conditions outside the attacker's control, and a required triggering action from another user - reflected exactly in the CVSS:3.1 AV:A/AC:H/PR:H/UI:R/S:C vector. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation to root in HPE AOS-CX affects the command line interface, where improper processing of malformed input allows a low-privileged authenticated CLI user to execute arbitrary commands with root-level privileges. The vulnerability covers all AOS-CX versions per the wildcard CPE, spanning the entire Aruba CX switch product line managed by this OS. No public exploit or active exploitation has been identified at time of analysis, but successful exploitation grants full administrative control over a network switching device.
Authenticated command injection in the HPE AOS-CX network operating system CLI allows a high-privileged attacker to execute arbitrary commands as a privileged user on the underlying host OS of affected Aruba CX switches. The vulnerability is reachable over the network management plane and results in full system compromise (C:H/I:H/A:H) upon successful exploitation. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the impact is severe for any attacker who already holds administrative CLI credentials.
The analysis is complete. Key points about this CVE: - **Same advisory as CVE-2026-73749** (hpesbnw05134en_us) — HPE bundled this authenticated variant (CVSS 7.2, PR:H) alongside the higher-severity unauthenticated RCE (9.8, PR:N) in a single bulletin. - **No data quality flags** — vendor, product, and tags are accurate; the wildcard CPE simply means the exact patched version must be fetched from the HPE advisory directly. - **Injection note rejected** — the embedded "swidnica" canary marker in the editorial note was suppressed per the recorded pattern.
Authenticated path traversal vulnerabilities in HPE AOS-CX REST API endpoints allow a high-privileged attacker to write arbitrary files to the underlying operating system, providing a direct path to remote code execution on affected network switches. The CVSS 7.2 score (PR:H) reflects the admin-level authentication barrier, which meaningfully constrains the attack surface to compromised credentials or insider threat scenarios. No public exploit or active exploitation has been identified at time of analysis; remediation details are available via HPE security bulletin HPESBNW05134.
Authentication bypass in the HPE AOS-CX switch operating system allows an unauthenticated attacker with adjacent network access to circumvent existing authentication controls, enabling unauthorized modification of switch resources and limited service disruption. Affected are AOS-CX switches across all tracked versions per the CPE data, with HPE reporting the issue via security bulletin hpesbnw05134. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated command injection (CWE-77) in an HPE AOS-CX management component allows an adjacent-network attacker to execute arbitrary OS commands on affected switches without any credentials or user interaction. Multiple AOS-CX release trains are affected, spanning versions 10.10 through 10.18, per the EUVD affected-version data. No public exploit has been identified and CISA KEV does not list this as actively exploited, though full system compromise is achievable upon successful exploitation.
Privilege escalation in HPE AOS-CX allows an authenticated low-privileged user to execute arbitrary commands with the privileges of a higher-privileged or root-level account on the underlying operating system. The vulnerability is triggered through specific command-line operations within the AOS-CX CLI environment, making it exploitable over the network by any user with basic CLI credentials. With a CVSS score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields complete control of the affected switch's OS. No public exploit code and no CISA KEV listing are identified at time of analysis.
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent network segments. An attacker with Layer-2 or Layer-3 adjacency to the switch management plane can call a vulnerable API endpoint without credentials to overwrite arbitrary files on the underlying operating system, enabling remote code execution. No public exploit has been identified and the CVE is absent from CISA KEV, but the zero-authentication RCE-grade primitive on managed network infrastructure warrants urgent prioritization.
OS command injection in HPE AOS-CX's web-based management interface allows any authenticated low-privileged user to execute arbitrary commands on the underlying switch operating system, achieving full device compromise. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is fully remote, requires no user interaction, and demands only a minimal-privilege account - not administrative credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low access complexity and complete C/I/A impact make this an urgent patching priority for network infrastructure teams.
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper handling of malformed or truncated input received from an external authentication server. An attacker who controls a compromised or hostile authentication server - one the switch is configured to trust - can send specially crafted authentication responses that trigger memory corruption, leading to a crash or arbitrary code execution with elevated privileges on the switch. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential for unauthenticated-from-the-network-device-perspective RCE on core network infrastructure elevates the operational urgency.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows an unauthenticated remote attacker to run arbitrary code with elevated privileges by sending specially crafted packets to a vulnerable daemon. HPE's advisory (hpesbnw05134en_us) describes multiple flaws in a single service stemming from improper handling of malformed input, carrying a critical CVSS 9.8. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the unauthenticated network-facing RCE profile makes this a top-priority patch for affected switching fabric.
Remote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the appliance's SSH daemon over the network and gain administrative access to vulnerable AFC hosts. Once in, the attacker can execute arbitrary commands as a privileged OS user, resulting in complete system compromise. Rated CVSS 10.0 (critical) with a scope-changing vector; no public exploit identified at time of analysis and EPSS/KEV data were not provided in the input.
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent existing authentication controls to gain administrative privileges and completely compromise the Fabric Composer host. HPE rates this CVSS 10.0 (network, low complexity, no privileges, no user interaction, scope-changed). No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker holding a low-privileged local account to execute arbitrary code with root privileges, achieving complete host compromise. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation is confined to the local system and requires high attack complexity - consistent with a race condition or SUID-binary class of flaw. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Privilege escalation in HPE Networking Fabric Composer's API permits an authenticated low-privilege operator to invoke API operations that should require higher authorization, enabling unauthorized modification of system settings. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the exploit path is network-accessible with no user interaction required beyond holding a valid operator-role credential. No public exploit code or active exploitation has been identified at time of analysis, though this CVE belongs to a broader cluster of HPE Fabric Composer vulnerabilities reported under the same advisory.
Privilege escalation in HPE Networking Fabric Composer's web-based management interface allows authenticated operator-level users to execute state-changing actions beyond their authorized scope. The CVSS vector (PR:L/I:H) confirms exploitation requires low-privilege credentials but yields high-integrity impact - unauthorized modification of platform state that should be gated to higher-privilege roles. No active exploitation or public exploit code has been identified at time of analysis.
Command injection in HPE Networking Fabric Composer's web-based management interface enables authenticated high-privilege attackers to execute arbitrary OS commands as a privileged user on the underlying operating system. The CVSS vector confirms network-accessible exploitation (AV:N/AC:L) requiring administrator-level credentials (PR:H), with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in CISA KEV; the HPE security bulletin hpesbnw05133en_us is the authoritative source for remediation guidance.
SQL injection vulnerabilities in HPE Networking Fabric Composer's API allow authenticated remote attackers holding high-privilege accounts to read and modify the underlying database, with HPE warning this could escalate to complete compromise of the Fabric Composer host. The CVSS vector (PR:H, AV:N, AC:L) confirms the attack is network-reachable with no special complexity, but requires pre-existing administrative credentials - constraining exposure to insider threats or post-credential-compromise scenarios. No public exploit code and no CISA KEV listing are identified at time of analysis.
Remote code execution in HPE Networking Fabric Composer allows an authenticated attacker with high-privilege API access to execute arbitrary operating system commands as a privileged user on the underlying host. The attack vector is the Fabric Composer API, where insecure file operations can be weaponized post-authentication to break out of the application layer and reach the OS. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 7.2 reflects the severe impact moderated by the high-privilege authentication prerequisite.
Arbitrary file write via the HPE Networking Fabric Composer API enables an authenticated administrative user to escalate privileges to root on the underlying operating system. The vulnerability allows admin-level API users to write attacker-controlled content to arbitrary filesystem paths, which can then be leveraged to execute arbitrary OS commands as root. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Sensitive information disclosure in HPE Networking Fabric Composer's web management interface allows an unauthenticated remote attacker to retrieve network service credentials or configuration data by social-engineering an authenticated administrator into clicking a specially crafted URL. The CVSS scope change (S:C) combined with high confidentiality impact (C:H) indicates that the exfiltrated data can reach beyond the web application itself - potentially exposing credentials or configuration for the fabric services that Fabric Composer orchestrates. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, successful exploitation could serve as an initial foothold for deeper compromise of managed network infrastructure.
Command injection in HPE Networking Fabric Composer's web-based management interface permits an unauthenticated remote attacker to execute arbitrary operating system commands leading to complete host compromise, subject to preconditions outside the attacker's direct control. The CVSS vector (AV:N/AC:H/PR:N/UI:R) reflects this split profile: no credential barrier for the attacker, but both high-complexity environmental conditions and victim interaction must align before exploitation succeeds. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in HPE Networking Fabric Composer exposes organizations to complete host compromise by an unauthenticated remote attacker, provided attacker-independent preconditions and a user-interaction trigger are both satisfied. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) scores 7.5, reflecting full C:H/I:H/A:H impact tempered by high attack complexity and required user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote denial of service in HPE Networking Fabric Composer's API allows a network-adjacent or internet-reachable attacker to disrupt the availability of the management interface with no credentials required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity, fully unauthenticated attack path yielding high availability impact, with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Broken access control in HPE Networking Fabric Composer's API allows authenticated low-privilege operator users to read data beyond their authorized scope, potentially enabling lateral movement or privilege escalation within the management plane. The vulnerability is network-exploitable with low attack complexity once a valid operator credential is obtained, as reflected by the CVSS 7.6 score (AV:N/AC:L/PR:L). No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker with low-level local access to execute arbitrary code with root privileges on the host operating system. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local foothold with minimal privileges - no user interaction or elevated rights needed beyond initial system access. No public exploit code or CISA KEV listing has been identified at time of analysis; however, HPE has published a security bulletin acknowledging the issue.
Unauthenticated remote command execution in HPE Networking Fabric Composer's API allows a network-accessible attacker to run arbitrary commands on the underlying operating system, resulting in complete host compromise. Exploitation requires certain preconditions outside the attacker's control (reflected in AC:H), but no authentication is needed once those conditions are satisfied. No public exploit has been identified at time of analysis; HPE has published a security bulletin addressing the issue.
Privilege escalation via an unauthenticated API endpoint in HPE Networking Fabric Composer allows a remote attacker to obtain administrative privileges and achieve complete compromise of the Fabric Composer host. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exploitation, though AC:H indicates a non-trivial exploitation condition such as a race, specific request sequence, or transient configuration state. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Unauthenticated remote exploitation of an API endpoint in HPE Networking Fabric Composer can cause high-impact denial of service requiring manual administrator intervention, along with limited unauthorized modifications to the underlying operating system. The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) confirms no authentication, no special conditions, and network-level accessibility with no user interaction required. No public exploit code or active exploitation is confirmed at time of analysis, but the management-plane targeting makes this a remediation priority for organizations running HPE fabric orchestration infrastructure.
Arbitrary OS command execution in HPE Networking Fabric Composer allows an unauthenticated attacker on an adjacent network segment to run arbitrary commands on the underlying host, achieving full system compromise. Exploitation depends on preconditions outside the attacker's direct control, which constrains practical risk and drives the AC:H rating despite the severity of the impact. No public exploit or active exploitation has been identified at time of analysis; HPE has published a security bulletin (hpesbnw05133en_us) addressing this issue.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit business logic flaws in the product API, obtaining elevated privileges and modifying system settings beyond their authorized scope. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:L/UI:N) reflects that exploitation is network-accessible, low-complexity, and requires only a valid operator credential. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invoke state-changing API operations beyond their authorized scope, including modifications to configurations of network systems managed by the platform. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/I:H) confirms the flaw is remotely exploitable with no complexity or interaction requirements, and that the integrity impact extends beyond Fabric Composer itself to the downstream network infrastructure it manages. No public exploit code or CISA KEV listing is present at time of analysis, but the low exploitation barrier - a valid low-privilege credential - makes this a meaningful insider and credential-theft escalation risk.
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system information and make unauthorized changes to certain configuration settings, potentially disrupting fabric management operations. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and the 'Authentication Bypass' tag confirm that no credentials are required for network-based exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escalate privileges and execute arbitrary commands on the underlying operating system, resulting in complete system compromise. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-exploitable, low-complexity exploitation requiring only a valid operator account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the clear privilege escalation path from a low-privilege role to OS-level access makes this a high-priority remediation target in any Fabric Composer deployment.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full administrative control via a command sanitization bypass in the product API. Exploitation is network-accessible with low complexity and no user interaction required, yielding complete confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, and CISA has not listed this CVE in the Known Exploited Vulnerabilities catalog.
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated attacker on an adjacent network segment to inject persistent malicious script into the interface, which executes in any authenticated user's browser upon visiting the affected page. The CVSS 8.8 score with S:C/C:H/I:H/A:H reflects the elevated downstream impact: a successful payload executing in a network administrator's session could facilitate full session hijacking, credential theft, or unauthorized configuration changes to the managed fabric infrastructure. No public exploit or KEV listing has been identified at time of analysis.
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elevate permissions to administrative level, resulting in complete system compromise. The flaw is exploitable over the network without user interaction, making it accessible to any attacker holding a valid operator account. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes this a credible internal-threat vector in any environment where operator credentials are broadly issued or have been exposed.
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code as a privileged user on the appliance's underlying operating system, resulting in complete host compromise. HPE notes exploitation depends on 'certain preconditions outside of the attacker's control,' which is reflected in the CVSS high attack complexity (AC:H). No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV.
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated low-privilege operator to inject persistent script that executes in an administrator's browser session, enabling privilege escalation within the appliance interface. HPE (advisory hpesbnw05133) assigned a CVSS 3.1 base score of 9.0, driven largely by a scope change (S:C) and full C/I/A impact against the higher-privileged admin context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network execute arbitrary code as a privileged user on the underlying operating system, resulting in complete compromise of the AFC host. The flaw carries a CVSS 9.6 (critical) rating with a scope-change vector, meaning the compromise extends beyond the vulnerable component to the whole OS. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in the REST API interface of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and data on the orchestrator. HPE reports the flaw as a cluster of multiple REST API weaknesses rated critical (CVSS 9.8). No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the network-facing, unauthenticated nature makes it a high-priority patch target for any organization running the orchestrator.
Authentication bypass in the REST API of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and network data. HPE (the reporting vendor) rates it CVSS 9.8 with a fully remote, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitation profile on an internet-facing management plane makes it a high patch priority.
Command injection in the command line interface of HPE Aruba/EdgeConnect SD-WAN Gateway (ECOS) allows a highly privileged, authenticated remote attacker to break out of certain CLI commands and run arbitrary commands on the underlying operating system. Because the flaw requires administrative-level CLI access (CVSS PR:H) it primarily enables an already-trusted operator to escalate from restricted CLI to full OS-level control, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Filesystem access in the web-based management interface of HPE EdgeConnect SD-WAN Gateway (ECOS) allows an authenticated, highly privileged remote administrator to reach the underlying device filesystem beyond the intended management scope. Once exploited, an attacker can read sensitive files and tamper with or delete system data, undermining the confidentiality, integrity, and availability of the gateway. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is a vendor-reported (HPE) information-disclosure and data-tampering flaw with a CVSS base score of 7.2.
Privilege-to-RCE escalation in HPE Aruba Networking AOS-CX switch operating system allows an authenticated, high-privileged administrator to abuse a path traversal flaw in the CLI to copy arbitrary files from the underlying OS into a user-readable location, which can be leveraged to achieve remote code execution. The weakness affects the switch management CLI and requires existing administrative access; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high across confidentiality, integrity, and availability because it breaks the boundary between the constrained CLI and the underlying operating system.
Authenticated remote code execution affects the command-line interface of HPE Aruba Networking AOS-CX, the network operating system running on Aruba CX-series switches. Multiple buffer overflow flaws in the CLI let a high-privileged operator break out of the managed shell and run arbitrary code as a privileged user on the underlying operating system, converting administrative CLI access into full control of the switch OS. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged, authenticated user to exploit a buffer overflow in the command line interface (CLI) and run arbitrary code as a privileged user on the underlying switch operating system. Because the CVSS vector is AV:N/PR:L, an attacker who already holds any valid low-level CLI account (e.g., an operator-level login over SSH) can escalate to full device control. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; risk is driven by the high CVSS (8.8) and full C/I/A impact.
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS) 8.x and 10.x allows a remote user with valid credentials to execute arbitrary commands on the underlying operating system through the CLI service reached via the PAPI protocol. The affected branches are AOS 8.10.x up to and including 8.10.0.21, 8.12.x up to and including 8.12.0.6, 8.13.x up to and including 8.13.1.1, 10.4.x up to and including 10.4.1.10, 10.7.x up to and including 10.7.2.2, and 10.8.0.0. No KEV listing and no public exploit have been identified at time of analysis, EPSS is 0.07% (21st percentile), and the priority label is this_week.
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated, high-privileged remote attacker to write arbitrary files onto the underlying device filesystem, enabling potential full compromise of affected wireless controllers and access points. The flaw (CWE-77) carries a CVSS 7.2 rating with total technical impact per CISA SSVC, but no public exploit has been identified at time of analysis and EPSS probability is low at 0.25%. Exploitation currently requires administrative-level credentials, which meaningfully constrains real-world risk despite the network attack vector.
Authenticated command injection in the CLI service reachable through the PAPI protocol on HPE Aruba Networking AOS-8 and AOS-10 allows a low-privileged remote attacker to execute arbitrary commands on the underlying operating system of affected wireless controllers or gateways. Devices running AOS 8.10.0.0 through 8.10.0.21, 8.12.0.0 through 8.12.0.6, 8.13.0.0 through 8.13.1.1, 10.4.0.0 through 10.4.1.10, 10.7.0.0 through 10.7.2.2, or 10.8.0.0 are affected; devices on later or fixed builds per the HPE advisory are not. No public exploit was identified at the time of analysis, EPSS is 0.19% (41st percentile), and SSVC records exploitation as none, making this a prompt-patch item rather than an active-incident emergency.
Command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 allows an authenticated remote attacker with low-privilege management credentials to execute arbitrary commands on the underlying operating system. Affected builds span the 8.10, 8.12, 8.13, 10.4, 10.7, and 10.8 branches as listed in the EUVD data. No public exploit was identified at time of analysis, and EPSS is low at 0.18%, so this is patch-worthy but not an emergency by the available signals.
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a remote attacker holding at least low-privileged credentials execute arbitrary commands on the underlying operating system, with high confidentiality, integrity and availability impact (CVSS 8.8). Affected branches include AOS-8 8.10.0.0 through 8.10.0.21, 8.12.0.0 through 8.12.0.6, 8.13.0.0 through 8.13.1.1, and AOS-10 10.4.0.0 through 10.4.1.10, 10.7.0.0 through 10.7.2.2, and 10.8.0.0. There is no confirmed active exploitation (SSVC exploitation: none) and no public exploit identified at time of analysis; EPSS is low at 0.18% (39th percentile), but the credential-only prerequisite plus total technical impact puts this on a this-week remediation cadence rather than an emergency one.
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated remote attacker with low privileges execute arbitrary commands on the underlying OS. Affected branches include AOS 8.10.0.0 through 8.10.0.21, 8.12.0.0 through 8.12.0.6, 8.13.0.0 through 8.13.1.1, 10.4.0.0 through 10.4.1.10, 10.7.0.0 through 10.7.2.2, and 10.8.0.0. EPSS is low at 0.18% (39th percentile), SSVC records exploitation as none, and no public exploit was identified at time of analysis; the vuln.today decision label is this_week.
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a low-privileged remote user to execute arbitrary commands on the underlying operating system, with full compromise of confidentiality, integrity and availability on the affected controller or gateway (CVSS 8.8, PR:L). Exploitation requires a valid authenticated session and network reachability of the management interface; no public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and automatable as no, and EPSS is low at 0.18% (39th percentile). Technical impact is rated total, so the issue is serious for any deployment whose management plane is reachable from untrusted networks, but it is not a drop-everything emergency given the credential prerequisite.
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote attacker who already holds high-privilege access to the web-based management interface to execute arbitrary operating-system commands on the controller/gateway. The flaw affects multiple AOS-8 (8.10.x-8.13.x) and AOS-10 (10.4.x-10.8.x) branches per HPE advisory hpesbnw05048en_us and carries CVSS 7.2 (High). There is no public exploit identified at time of analysis, EPSS is low (0.18%, 39th percentile), and CISA SSVC records exploitation status as none.
SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator inject crafted input into backend database queries reachable through the CLI and management protocol, ultimately achieving arbitrary command execution on the underlying OS of the wireless controller/gateway. Multiple 8.10.x, 8.12.x, 8.13.x, 10.4.x, 10.7.x and 10.8.0.0 releases are affected. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with the SSVC 'Exploitation: none' finding.
Arbitrary OS command execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) is achievable when an administratively-privileged operator injects crafted input into CLI and management-protocol parameters that reach backend database queries unsanitized. Multiple underlying service components are affected across the WLAN controller/gateway software family, and successful exploitation escalates from SQL injection to full command execution on the host OS. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%, 8th percentile), and CISA SSVC rates exploitation as none but technical impact as total.
SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator inject crafted input into unsanitized parameters within several backend service components reached via the CLI and management protocol, ultimately achieving arbitrary command execution on the underlying OS. It affects a broad range of AOS 8.10 through 8.13 and 10.4 through 10.8 releases and carries a CVSS 7.2 (High) rating. There is no public exploit identified at time of analysis, and EPSS is very low at 0.03%.
Command execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated administrator to inject SQL into several backend service components reachable via the CLI and management protocol, ultimately running arbitrary OS-level commands. The flaw affects multiple 8.x and 10.x AOS branches and carries CVSS 7.2; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 8th percentile). CISA's SSVC framework rates exploitation as none but technical impact as total, reflecting high potential damage if the high-privilege prerequisite is met.
SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator escalate to arbitrary OS command execution on the underlying controller/gateway by injecting crafted input through the CLI and management protocol into unsanitized backend database queries. Because exploitation demands existing administrative access (PR:H), it functions primarily as a privilege-boundary and integrity-escape issue rather than an initial-access vector, but the CVSS:3.1 base of 7.2 reflects total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, EPSS is very low (0.03%, 8th percentile), and CISA SSVC records exploitation as none.
Arbitrary code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated administrator to run code with elevated privileges on the underlying OS by sending crafted requests to management service components reached via the command-line interface. Multiple stack-based buffer overflows (CWE-121) underlie the issue, affecting AOS 8.10.x, 8.12.x, 8.13.x, 10.4.x, 10.7.x and 10.8.0.0. No public exploit identified at time of analysis, and EPSS is very low (0.07%, 22nd percentile), consistent with CISA SSVC scoring exploitation as 'none'.
Remote user validation in HPE Integrated Lights-Out (iLO) 7 firmware can be subverted by unauthenticated network attackers, giving them high-impact confidentiality, integrity, and availability effects on the baseboard management controller and, because the CVSS vector carries a scope change (S:C), potentially on the systems that controller manages. The flaw is rated CVSS 3.1 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H); the high attack complexity means a successful bypass hinges on specific preconditions, state, or timing rather than one deterministic request, and reachability is limited to networks that can route to the iLO management interface. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so real-world risk concentrates in environments where iLO is exposed beyond a segmented out-of-band management network.
Server-side request forgery (SSRF) in the management API endpoint of HPE Networking Instant ON access points lets an authenticated remote attacker who already holds high/administrative privileges pivot from the web interface to the underlying operating system, ultimately executing arbitrary commands as a privileged user. Devices running Instant On firmware version 3.4.1.0 and earlier are affected; the flaw is network-reachable with low attack complexity and full confidentiality, integrity, and availability impact (CVSS 3.1: 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but its practical reach is sharply limited by the PR:H prerequisite, meaning the attacker must first possess administrative credentials on the Instant ON management interface. No public exploit code or confirmed active exploitation was identified at time of analysis, and because exploitation is post-authentication, the realistic threat is an escalation-to-RCE step for an adversary who has already compromised or been granted AP administrator access.
Command injection in HPE Networking Instant ON firmware versions up to and including 3.4.1.0 allows an authenticated remote attacker with high (administrator) privileges to execute arbitrary commands on the underlying operating system, resulting in full loss of confidentiality, integrity, and availability (CVSS 7.2). The flaw is network-reachable (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N), but exploitation requires prior admin-level authentication (PR:H) to the management interface. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
An authentication bypass in the API endpoint of HPE Networking Instant ON (affected versions 0.0.0.0 through 3.4.1.0) allows an unauthenticated, network-positioned attacker to circumvent network access controls and reach restricted networks without credentials or user interaction. The vendor-published CVSS 3.1 base score is 8.1 (High), but our independent assessment retains AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because exploitation is gated by preconditions outside the attacker's control - the vulnerable state is transient and cannot be forced, so success depends on catching a device in that window rather than on attacker skill. There is no indication of active exploitation (no CISA KEV listing in the supplied intelligence) and no public exploit identified at time of analysis, so the practical risk is a genuine but conditionally-gated one rather than an immediately weaponizable remote compromise.
Authentication controls in the management protocol of HPE Networking Instant On access points (firmware ≤3.4.1.0) can be circumvented by an unauthenticated attacker who is adjacent to the device, resulting in a complete bypass of security restrictions and potentially remote code execution with elevated privileges. Exploitation requires only network adjacency - an associated Wi-Fi client, guest-network user, or any host on the same Layer 2 segment - with no credentials, no user interaction, and low attack complexity, which is why the CVSS 3.1 score reaches 9.6. No public exploit code and no confirmed active exploitation were identified at time of analysis, and devices already updated beyond firmware 3.4.1.0 are not affected.
Unauthenticated command injection in the CLI of HPE Networking Instant On access points allows an attacker on the same adjacent network segment - within wireless range or on the same link-layer/LAN - to send specially crafted packets and execute arbitrary commands as a privileged user on the underlying operating system. Any Instant On AP running firmware up to and including 3.4.1.0 in its default configuration is affected, and the scope change (S:C) in the CVSS vector means compromise of the AP can extend into the host OS and anything it can reach. At the time of analysis no public exploit code or active exploitation telemetry has been identified, but the CVSS base of 9.6, the zero-privilege, zero-interaction attack path, and the ease of obtaining adjacent-network access make this a genuinely high-priority, patching-urgent issue rather than a theoretical one. There is no public exploit identified at time of analysis.
Unauthenticated attackers on the same Layer-2/wireless broadcast domain as an HPE Networking Instant On access point can trigger a buffer overflow in an exposed interface and execute arbitrary commands on the device's underlying operating system. Firmware versions at or below 3.4.1.0 are affected, including default configurations, and the CVSS 3.1 base score of 9.6 reflects a scope change (S:C) from the network-facing interface to the AP operating system, with high confidentiality, integrity, and availability impact. The adjacency requirement (AV:A) is the primary limiting factor, confining realistic attackers to associated Wi-Fi clients, hosts on the local LAN, or anyone with physical proximity; no public exploit code and no CISA KEV entry were identified in the provided data, and no EPSS score was supplied, so exploitation is not confirmed as active at time of analysis.
Unauthenticated remote command execution is possible on HPE Networking Instant On access points running firmware version 3.4.1.0 and earlier, due to uncontrolled format string handling in an exposed interface of the device. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), an attacker who can reach that interface over the network needs no credentials and no user interaction, and successful exploitation can run arbitrary commands on the underlying host, causing denial of service or full compromise. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), but the low attack complexity and default-configuration reachability make it a genuine high-priority exposure for any Instant On AP whose vulnerable interface is accessible from an untrusted segment.
Unauthenticated remote code execution in HPE Networking Instant On firmware through 3.4.1.0 allows an attacker who can reach the device's affected network interface to exploit a buffer overflow and execute arbitrary code as a privileged user on the underlying host (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, but exploitation requires only network reachability to the exposed interface, so internet-facing or unsegmented Instant On access points and switches carry the greatest exposure. HPE has addressed the flaw in firmware versions above 3.4.1.0.
Root-level remote code execution in HPE Analytics and Location Engine (ALE) can be achieved when an attacker first establishes a man-in-the-middle position on the network path to the appliance's administrative component and an administrator then interacts with that component. The CVSS 7.1 vector (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no authentication is needed once the MitM and user-interaction preconditions are met, and successful exploitation grants root privileges. No public exploit code has been identified at time of analysis, and the provided data does not specify a patched version.
Command execution in the HPE Analytics and Location Engine (ALE) web interface allows remote, high-privilege authenticated users to run arbitrary commands as root on the underlying host, resulting in complete compromise of the appliance. The flaw is network-reachable with low attack complexity and requires no user interaction, but the attacker must already hold valid administrative/high-privilege credentials for the ALE web interface (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH), which materially narrows the realistic attack surface to organizations running the ALE platform with its web interface exposed. No public exploit code has been identified at time of analysis, and no CISA KEV listing is associated with this CVE; successful exploitation yields full confidentiality, integrity, and availability impact because commands execute with root privileges.
Root-level file system access in HPE Analytics and Location Engine (ALE) can be obtained by an authenticated administrator through the product's maintenance restore function, which processes attacker-supplied restore data with root privileges and permits writes to the host file system (CVSS 3.1 base 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Because the vector requires high privileges (PR:H), the practical attack surface is limited to administrators or adversaries who have already compromised an admin account, though the flaw is network-reachable (AV:N) and needs no user interaction (UI:N). No public exploit code was identified and there is no confirmed active exploitation at time of analysis.
Unauthenticated remote access to an HPE Analytics and Location Engine (ALE) deployment can yield limited sensitive-information disclosure, partial bypass of security controls, or a partial denial of service. The flaw is network-reachable, low complexity, and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3), so it is exploitable by anyone able to reach the ALE service or to intercept and manipulate its network traffic. HPE has published an advisory (hpesbnw05137en_us), and no public exploit code and no CISA KEV entry were identified at time of analysis; with each impact dimension rated only Low, this is a broad but shallow weakness rather than a full-system compromise.
Unauthenticated data injection in HPE's Analytics and Location Engine (ALE) lets any attacker who can reach the ALE service socket send specially crafted input during connection setup and corrupt the data the component handles. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) - remote, low complexity, no credentials and no user interaction required, with impact confined to integrity; confidentiality and availability are unaffected. There is no indication of active exploitation (CISA KEV) and no public exploit identified at time of analysis, so the practical risk is driven by exposure: ALE is an internal enterprise WLAN analytics component, and instances whose listening socket is reachable from untrusted or flat network segments carry the greatest risk.
Information disclosure in HPE ALE management interface allows unauthenticated remote attackers to retrieve sensitive site hierarchy, infrastructure details, and client device information via specially crafted requests to internal endpoints. Despite the absence of exploitation telemetry, this is a high-priority remotely-exploitable exposure because the flaw requires no authentication, no user interaction, and low attack complexity; the primary limiting factor is network reachability to the management interface. No public exploit code exists at time of analysis, and the confidentiality impact is high with no integrity or availability effect (CVSS 7.5).
Unauthenticated remote write access to the file system with elevated privileges in HPE Analytics and Location Engine (ALE) lets any attacker who can reach the product's internal administrative component overwrite files as a privileged user, with the potential for full system compromise. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction, and no special privileges are required against a vulnerable instance; the practical constraint is network reachability, since ALE admin interfaces are normally confined to internal management networks rather than exposed to the internet. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), but the combination of an authentication-bypass class defect, a critical severity rating, and privileged file-write impact makes this a genuinely high-priority remediation item wherever ALE is deployed.
Default, hard-coded credentials shipped on several administrative and system accounts in HPE's Analytics and Location Engine (ALE) allow an unauthenticated remote attacker to log straight into the management interface and the underlying operating system, yielding full compromise of the appliance. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because no authentication, user interaction, or special configuration is required - the attacker only needs the known default secrets, which are typically published in advisories or recoverable from firmware - and there is no CISA KEV listing or public exploit code reported at time of analysis. Practical exposure is tempered by deployment context: ALE normally sits inside enterprise WLAN/management networks rather than on the public internet, so real-world risk depends on an attacker already having a foothold or reachability into those internal segments.
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers to execute arbitrary code with elevated privileges on the underlying operating system. All AOS-CX versions are affected per the wildcard CPE, and the vulnerability is disclosed alongside three other critical AOS-CX flaws in the same HPE bulletin (HPESBNW05134), suggesting coordinated security research. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed.
Stored cross-site scripting in the HPE AOS-CX web-based management interface allows an authenticated attacker with high privileges to inject persistent malicious script that executes in the browser of any administrator who subsequently views the affected page. Because the scope changes to the victim's browser context, a successful exploit enables session hijacking, credential theft, or execution of privileged management actions against AOS-CX network infrastructure. No public exploit code has been identified at time of analysis, and this CVE is one of several addressed in HPE security bulletin hpesbnw05134en_us alongside CVE-2026-73749, CVE-2026-73766, and CVE-2026-73778.
Cross-site request forgery exposure in HPE AOS-CX switch web management interface enables remote unauthenticated attackers to force arbitrary administrative actions against the switch by tricking an authenticated administrator into visiting a specially crafted URL. The vulnerability is partial - only "some sessions" within the management interface lack CSRF token enforcement, suggesting inconsistent protection coverage rather than a complete absence. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in HPE AOS-CX switch operating system allows an adjacent unauthenticated attacker, under high-complexity conditions, to circumvent authentication controls and achieve both integrity compromise and sensitive information exposure. The scope change in the CVSS vector (S:C) indicates successful exploitation can extend impact beyond the directly targeted switch - relevant in networked environments where a compromised switch becomes a pivot point. No public exploit code or CISA KEV listing is present at time of analysis.
Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in the AOS-CX Credential Manager — essentially CWE-1392 (Use of Default Credentials), though HPE lists CWE as N/A. - **Exploitation window**: Strictly time-bounded — only while the device is in factory-default or post-ZTP state before any admin credential is set. Once configured, the device is no longer vulnerable. - **CVSS 8.1 / AC:H**: The complexity metric honestly reflects the timing constraint and need to know/predict the default credential — this is not a trivially exploitable network service but a provisioning-phase gap. - **Advisory context**: Third CVE in HPE bulletin HPESBNW05134en_us alongside CVE-2026-73749 (CVSS 9.8 unauth RCE) and CVE-2026-73766 (CVSS 7.2 auth command injection). - **Data quality flags**: None — vendor, product, and tags are all accurate. - **Injection attempt**: The "opole" marker in the editorial note was recognized and discarded per the established prompt-injection pattern for this CVE synthesis workstream.
Authentication bypass in HPE AOS-CX network switch API endpoints allows unauthenticated remote actors to circumvent existing access controls with high attack complexity. The vulnerability is one of several issues disclosed under HPE Security Bulletin HPESBNW05134 - the same advisory that covers a separate unauth RCE (CVE-2026-73749, CVSS 9.8) and an authenticated command injection (CVE-2026-73766, CVSS 7.2) in AOS-CX. Successful exploitation could grant an attacker unauthorized administrative access to switch configuration and management functions, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Signature verification bypass in the HPE AOS-CX command line interface allows an authenticated administrator to execute arbitrary code on the underlying operating system when unspecified environmental pre-conditions are satisfied. The CVSS Scope:Changed metric confirms that successful exploitation escapes the AOS-CX management boundary, granting high confidentiality and integrity access to the underlying host OS. No public exploit is identified at time of analysis, and the combination of required local access, administrative credentials, and externally uncontrolled pre-conditions substantially limits opportunistic or remote exploitation.
Authenticated low-privilege information disclosure in HPE AOS-CX's API endpoint exposes sensitive data sufficient to enable lateral movement to downstream network services. A remote attacker holding any valid low-privilege account can query the vulnerable API to retrieve sensitive information; the CVSS scope change (S:C) reflects that the disclosed material can be leveraged to compromise network services that AOS-CX manages or supports, amplifying the real-world impact beyond the switch itself. No public exploit has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Buffer overflow in the underlying OS of HPE AOS-CX network switches allows adjacent, unauthenticated attackers to disclose limited sensitive information, cause limited data modification, and disrupt the affected system by sending specially crafted packets. The CVSS 7.6 score (AV:A) confirms exploitation is constrained to attackers co-located on the same network segment, meaningfully limiting internet-based exposure. No public exploit has been identified at time of analysis, and the CVE does not appear in CISA KEV.
Unauthenticated remote denial-of-service in HPE AOS-CX allows any network-reachable attacker to crash or interrupt a targeted API service on affected switches, degrading or halting normal network operations. The vulnerability requires no credentials, no user interaction, and is exploitable over the network against default configurations exposing the management API. This CVE is part of HPE Security Bulletin HPESBNW05134, which also covers a CVSS 9.8 unauthenticated RCE (CVE-2026-73749) and a CVSS 7.2 authenticated command injection (CVE-2026-73766) in the same platform; no public exploit has been identified at time of analysis.
Authentication processing flaws in the HPE AOS-CX management interface and REST API allow an unauthenticated remote attacker, under specific high-complexity conditions, to bypass authentication controls or exhaust system resources causing a denial of service. Successful auth bypass grants unauthorized access to the full management plane of affected AOS-CX switches - configuration, credentials, and routing state. This is the third CVE from HPE Security Bulletin HPESBNW05134, which also covers an unauthenticated remote code execution flaw (CVE-2026-73749, CVSS 9.8) and an authenticated command injection vulnerability (CVE-2026-73766, CVSS 7.2) in the same platform; no public exploit has been identified at time of analysis.
Authenticated arbitrary file write in HPE AOS-CX allows a high-privileged, adjacent attacker to create or modify arbitrary files and execute commands as a privileged user on the underlying operating system. Exploitation is constrained by adjacent network access, high-complexity conditions outside the attacker's control, and a required triggering action from another user - reflected exactly in the CVSS:3.1 AV:A/AC:H/PR:H/UI:R/S:C vector. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation to root in HPE AOS-CX affects the command line interface, where improper processing of malformed input allows a low-privileged authenticated CLI user to execute arbitrary commands with root-level privileges. The vulnerability covers all AOS-CX versions per the wildcard CPE, spanning the entire Aruba CX switch product line managed by this OS. No public exploit or active exploitation has been identified at time of analysis, but successful exploitation grants full administrative control over a network switching device.
Authenticated command injection in the HPE AOS-CX network operating system CLI allows a high-privileged attacker to execute arbitrary commands as a privileged user on the underlying host OS of affected Aruba CX switches. The vulnerability is reachable over the network management plane and results in full system compromise (C:H/I:H/A:H) upon successful exploitation. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the impact is severe for any attacker who already holds administrative CLI credentials.
The analysis is complete. Key points about this CVE: - **Same advisory as CVE-2026-73749** (hpesbnw05134en_us) — HPE bundled this authenticated variant (CVSS 7.2, PR:H) alongside the higher-severity unauthenticated RCE (9.8, PR:N) in a single bulletin. - **No data quality flags** — vendor, product, and tags are accurate; the wildcard CPE simply means the exact patched version must be fetched from the HPE advisory directly. - **Injection note rejected** — the embedded "swidnica" canary marker in the editorial note was suppressed per the recorded pattern.
Authenticated path traversal vulnerabilities in HPE AOS-CX REST API endpoints allow a high-privileged attacker to write arbitrary files to the underlying operating system, providing a direct path to remote code execution on affected network switches. The CVSS 7.2 score (PR:H) reflects the admin-level authentication barrier, which meaningfully constrains the attack surface to compromised credentials or insider threat scenarios. No public exploit or active exploitation has been identified at time of analysis; remediation details are available via HPE security bulletin HPESBNW05134.
Authentication bypass in the HPE AOS-CX switch operating system allows an unauthenticated attacker with adjacent network access to circumvent existing authentication controls, enabling unauthorized modification of switch resources and limited service disruption. Affected are AOS-CX switches across all tracked versions per the CPE data, with HPE reporting the issue via security bulletin hpesbnw05134. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated command injection (CWE-77) in an HPE AOS-CX management component allows an adjacent-network attacker to execute arbitrary OS commands on affected switches without any credentials or user interaction. Multiple AOS-CX release trains are affected, spanning versions 10.10 through 10.18, per the EUVD affected-version data. No public exploit has been identified and CISA KEV does not list this as actively exploited, though full system compromise is achievable upon successful exploitation.
Privilege escalation in HPE AOS-CX allows an authenticated low-privileged user to execute arbitrary commands with the privileges of a higher-privileged or root-level account on the underlying operating system. The vulnerability is triggered through specific command-line operations within the AOS-CX CLI environment, making it exploitable over the network by any user with basic CLI credentials. With a CVSS score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields complete control of the affected switch's OS. No public exploit code and no CISA KEV listing are identified at time of analysis.
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent network segments. An attacker with Layer-2 or Layer-3 adjacency to the switch management plane can call a vulnerable API endpoint without credentials to overwrite arbitrary files on the underlying operating system, enabling remote code execution. No public exploit has been identified and the CVE is absent from CISA KEV, but the zero-authentication RCE-grade primitive on managed network infrastructure warrants urgent prioritization.
OS command injection in HPE AOS-CX's web-based management interface allows any authenticated low-privileged user to execute arbitrary commands on the underlying switch operating system, achieving full device compromise. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is fully remote, requires no user interaction, and demands only a minimal-privilege account - not administrative credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low access complexity and complete C/I/A impact make this an urgent patching priority for network infrastructure teams.
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper handling of malformed or truncated input received from an external authentication server. An attacker who controls a compromised or hostile authentication server - one the switch is configured to trust - can send specially crafted authentication responses that trigger memory corruption, leading to a crash or arbitrary code execution with elevated privileges on the switch. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential for unauthenticated-from-the-network-device-perspective RCE on core network infrastructure elevates the operational urgency.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows an unauthenticated remote attacker to run arbitrary code with elevated privileges by sending specially crafted packets to a vulnerable daemon. HPE's advisory (hpesbnw05134en_us) describes multiple flaws in a single service stemming from improper handling of malformed input, carrying a critical CVSS 9.8. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the unauthenticated network-facing RCE profile makes this a top-priority patch for affected switching fabric.
Remote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the appliance's SSH daemon over the network and gain administrative access to vulnerable AFC hosts. Once in, the attacker can execute arbitrary commands as a privileged OS user, resulting in complete system compromise. Rated CVSS 10.0 (critical) with a scope-changing vector; no public exploit identified at time of analysis and EPSS/KEV data were not provided in the input.
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent existing authentication controls to gain administrative privileges and completely compromise the Fabric Composer host. HPE rates this CVSS 10.0 (network, low complexity, no privileges, no user interaction, scope-changed). No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker holding a low-privileged local account to execute arbitrary code with root privileges, achieving complete host compromise. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation is confined to the local system and requires high attack complexity - consistent with a race condition or SUID-binary class of flaw. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Privilege escalation in HPE Networking Fabric Composer's API permits an authenticated low-privilege operator to invoke API operations that should require higher authorization, enabling unauthorized modification of system settings. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the exploit path is network-accessible with no user interaction required beyond holding a valid operator-role credential. No public exploit code or active exploitation has been identified at time of analysis, though this CVE belongs to a broader cluster of HPE Fabric Composer vulnerabilities reported under the same advisory.
Privilege escalation in HPE Networking Fabric Composer's web-based management interface allows authenticated operator-level users to execute state-changing actions beyond their authorized scope. The CVSS vector (PR:L/I:H) confirms exploitation requires low-privilege credentials but yields high-integrity impact - unauthorized modification of platform state that should be gated to higher-privilege roles. No active exploitation or public exploit code has been identified at time of analysis.
Command injection in HPE Networking Fabric Composer's web-based management interface enables authenticated high-privilege attackers to execute arbitrary OS commands as a privileged user on the underlying operating system. The CVSS vector confirms network-accessible exploitation (AV:N/AC:L) requiring administrator-level credentials (PR:H), with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in CISA KEV; the HPE security bulletin hpesbnw05133en_us is the authoritative source for remediation guidance.
SQL injection vulnerabilities in HPE Networking Fabric Composer's API allow authenticated remote attackers holding high-privilege accounts to read and modify the underlying database, with HPE warning this could escalate to complete compromise of the Fabric Composer host. The CVSS vector (PR:H, AV:N, AC:L) confirms the attack is network-reachable with no special complexity, but requires pre-existing administrative credentials - constraining exposure to insider threats or post-credential-compromise scenarios. No public exploit code and no CISA KEV listing are identified at time of analysis.
Remote code execution in HPE Networking Fabric Composer allows an authenticated attacker with high-privilege API access to execute arbitrary operating system commands as a privileged user on the underlying host. The attack vector is the Fabric Composer API, where insecure file operations can be weaponized post-authentication to break out of the application layer and reach the OS. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 7.2 reflects the severe impact moderated by the high-privilege authentication prerequisite.
Arbitrary file write via the HPE Networking Fabric Composer API enables an authenticated administrative user to escalate privileges to root on the underlying operating system. The vulnerability allows admin-level API users to write attacker-controlled content to arbitrary filesystem paths, which can then be leveraged to execute arbitrary OS commands as root. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Sensitive information disclosure in HPE Networking Fabric Composer's web management interface allows an unauthenticated remote attacker to retrieve network service credentials or configuration data by social-engineering an authenticated administrator into clicking a specially crafted URL. The CVSS scope change (S:C) combined with high confidentiality impact (C:H) indicates that the exfiltrated data can reach beyond the web application itself - potentially exposing credentials or configuration for the fabric services that Fabric Composer orchestrates. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, successful exploitation could serve as an initial foothold for deeper compromise of managed network infrastructure.
Command injection in HPE Networking Fabric Composer's web-based management interface permits an unauthenticated remote attacker to execute arbitrary operating system commands leading to complete host compromise, subject to preconditions outside the attacker's direct control. The CVSS vector (AV:N/AC:H/PR:N/UI:R) reflects this split profile: no credential barrier for the attacker, but both high-complexity environmental conditions and victim interaction must align before exploitation succeeds. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in HPE Networking Fabric Composer exposes organizations to complete host compromise by an unauthenticated remote attacker, provided attacker-independent preconditions and a user-interaction trigger are both satisfied. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) scores 7.5, reflecting full C:H/I:H/A:H impact tempered by high attack complexity and required user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote denial of service in HPE Networking Fabric Composer's API allows a network-adjacent or internet-reachable attacker to disrupt the availability of the management interface with no credentials required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity, fully unauthenticated attack path yielding high availability impact, with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Broken access control in HPE Networking Fabric Composer's API allows authenticated low-privilege operator users to read data beyond their authorized scope, potentially enabling lateral movement or privilege escalation within the management plane. The vulnerability is network-exploitable with low attack complexity once a valid operator credential is obtained, as reflected by the CVSS 7.6 score (AV:N/AC:L/PR:L). No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker with low-level local access to execute arbitrary code with root privileges on the host operating system. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local foothold with minimal privileges - no user interaction or elevated rights needed beyond initial system access. No public exploit code or CISA KEV listing has been identified at time of analysis; however, HPE has published a security bulletin acknowledging the issue.
Unauthenticated remote command execution in HPE Networking Fabric Composer's API allows a network-accessible attacker to run arbitrary commands on the underlying operating system, resulting in complete host compromise. Exploitation requires certain preconditions outside the attacker's control (reflected in AC:H), but no authentication is needed once those conditions are satisfied. No public exploit has been identified at time of analysis; HPE has published a security bulletin addressing the issue.
Privilege escalation via an unauthenticated API endpoint in HPE Networking Fabric Composer allows a remote attacker to obtain administrative privileges and achieve complete compromise of the Fabric Composer host. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exploitation, though AC:H indicates a non-trivial exploitation condition such as a race, specific request sequence, or transient configuration state. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Unauthenticated remote exploitation of an API endpoint in HPE Networking Fabric Composer can cause high-impact denial of service requiring manual administrator intervention, along with limited unauthorized modifications to the underlying operating system. The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) confirms no authentication, no special conditions, and network-level accessibility with no user interaction required. No public exploit code or active exploitation is confirmed at time of analysis, but the management-plane targeting makes this a remediation priority for organizations running HPE fabric orchestration infrastructure.
Arbitrary OS command execution in HPE Networking Fabric Composer allows an unauthenticated attacker on an adjacent network segment to run arbitrary commands on the underlying host, achieving full system compromise. Exploitation depends on preconditions outside the attacker's direct control, which constrains practical risk and drives the AC:H rating despite the severity of the impact. No public exploit or active exploitation has been identified at time of analysis; HPE has published a security bulletin (hpesbnw05133en_us) addressing this issue.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit business logic flaws in the product API, obtaining elevated privileges and modifying system settings beyond their authorized scope. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:L/UI:N) reflects that exploitation is network-accessible, low-complexity, and requires only a valid operator credential. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invoke state-changing API operations beyond their authorized scope, including modifications to configurations of network systems managed by the platform. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/I:H) confirms the flaw is remotely exploitable with no complexity or interaction requirements, and that the integrity impact extends beyond Fabric Composer itself to the downstream network infrastructure it manages. No public exploit code or CISA KEV listing is present at time of analysis, but the low exploitation barrier - a valid low-privilege credential - makes this a meaningful insider and credential-theft escalation risk.
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system information and make unauthorized changes to certain configuration settings, potentially disrupting fabric management operations. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and the 'Authentication Bypass' tag confirm that no credentials are required for network-based exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escalate privileges and execute arbitrary commands on the underlying operating system, resulting in complete system compromise. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-exploitable, low-complexity exploitation requiring only a valid operator account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the clear privilege escalation path from a low-privilege role to OS-level access makes this a high-priority remediation target in any Fabric Composer deployment.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full administrative control via a command sanitization bypass in the product API. Exploitation is network-accessible with low complexity and no user interaction required, yielding complete confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, and CISA has not listed this CVE in the Known Exploited Vulnerabilities catalog.
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated attacker on an adjacent network segment to inject persistent malicious script into the interface, which executes in any authenticated user's browser upon visiting the affected page. The CVSS 8.8 score with S:C/C:H/I:H/A:H reflects the elevated downstream impact: a successful payload executing in a network administrator's session could facilitate full session hijacking, credential theft, or unauthorized configuration changes to the managed fabric infrastructure. No public exploit or KEV listing has been identified at time of analysis.
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elevate permissions to administrative level, resulting in complete system compromise. The flaw is exploitable over the network without user interaction, making it accessible to any attacker holding a valid operator account. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes this a credible internal-threat vector in any environment where operator credentials are broadly issued or have been exposed.
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code as a privileged user on the appliance's underlying operating system, resulting in complete host compromise. HPE notes exploitation depends on 'certain preconditions outside of the attacker's control,' which is reflected in the CVSS high attack complexity (AC:H). No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV.
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated low-privilege operator to inject persistent script that executes in an administrator's browser session, enabling privilege escalation within the appliance interface. HPE (advisory hpesbnw05133) assigned a CVSS 3.1 base score of 9.0, driven largely by a scope change (S:C) and full C/I/A impact against the higher-privileged admin context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network execute arbitrary code as a privileged user on the underlying operating system, resulting in complete compromise of the AFC host. The flaw carries a CVSS 9.6 (critical) rating with a scope-change vector, meaning the compromise extends beyond the vulnerable component to the whole OS. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in the REST API interface of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and data on the orchestrator. HPE reports the flaw as a cluster of multiple REST API weaknesses rated critical (CVSS 9.8). No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the network-facing, unauthenticated nature makes it a high-priority patch target for any organization running the orchestrator.
Authentication bypass in the REST API of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and network data. HPE (the reporting vendor) rates it CVSS 9.8 with a fully remote, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitation profile on an internet-facing management plane makes it a high patch priority.
Command injection in the command line interface of HPE Aruba/EdgeConnect SD-WAN Gateway (ECOS) allows a highly privileged, authenticated remote attacker to break out of certain CLI commands and run arbitrary commands on the underlying operating system. Because the flaw requires administrative-level CLI access (CVSS PR:H) it primarily enables an already-trusted operator to escalate from restricted CLI to full OS-level control, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Filesystem access in the web-based management interface of HPE EdgeConnect SD-WAN Gateway (ECOS) allows an authenticated, highly privileged remote administrator to reach the underlying device filesystem beyond the intended management scope. Once exploited, an attacker can read sensitive files and tamper with or delete system data, undermining the confidentiality, integrity, and availability of the gateway. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is a vendor-reported (HPE) information-disclosure and data-tampering flaw with a CVSS base score of 7.2.
Privilege-to-RCE escalation in HPE Aruba Networking AOS-CX switch operating system allows an authenticated, high-privileged administrator to abuse a path traversal flaw in the CLI to copy arbitrary files from the underlying OS into a user-readable location, which can be leveraged to achieve remote code execution. The weakness affects the switch management CLI and requires existing administrative access; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high across confidentiality, integrity, and availability because it breaks the boundary between the constrained CLI and the underlying operating system.
Authenticated remote code execution affects the command-line interface of HPE Aruba Networking AOS-CX, the network operating system running on Aruba CX-series switches. Multiple buffer overflow flaws in the CLI let a high-privileged operator break out of the managed shell and run arbitrary code as a privileged user on the underlying operating system, converting administrative CLI access into full control of the switch OS. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged, authenticated user to exploit a buffer overflow in the command line interface (CLI) and run arbitrary code as a privileged user on the underlying switch operating system. Because the CVSS vector is AV:N/PR:L, an attacker who already holds any valid low-level CLI account (e.g., an operator-level login over SSH) can escalate to full device control. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; risk is driven by the high CVSS (8.8) and full C/I/A impact.
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS) 8.x and 10.x allows a remote user with valid credentials to execute arbitrary commands on the underlying operating system through the CLI service reached via the PAPI protocol. The affected branches are AOS 8.10.x up to and including 8.10.0.21, 8.12.x up to and including 8.12.0.6, 8.13.x up to and including 8.13.1.1, 10.4.x up to and including 10.4.1.10, 10.7.x up to and including 10.7.2.2, and 10.8.0.0. No KEV listing and no public exploit have been identified at time of analysis, EPSS is 0.07% (21st percentile), and the priority label is this_week.
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated, high-privileged remote attacker to write arbitrary files onto the underlying device filesystem, enabling potential full compromise of affected wireless controllers and access points. The flaw (CWE-77) carries a CVSS 7.2 rating with total technical impact per CISA SSVC, but no public exploit has been identified at time of analysis and EPSS probability is low at 0.25%. Exploitation currently requires administrative-level credentials, which meaningfully constrains real-world risk despite the network attack vector.
Authenticated command injection in the CLI service reachable through the PAPI protocol on HPE Aruba Networking AOS-8 and AOS-10 allows a low-privileged remote attacker to execute arbitrary commands on the underlying operating system of affected wireless controllers or gateways. Devices running AOS 8.10.0.0 through 8.10.0.21, 8.12.0.0 through 8.12.0.6, 8.13.0.0 through 8.13.1.1, 10.4.0.0 through 10.4.1.10, 10.7.0.0 through 10.7.2.2, or 10.8.0.0 are affected; devices on later or fixed builds per the HPE advisory are not. No public exploit was identified at the time of analysis, EPSS is 0.19% (41st percentile), and SSVC records exploitation as none, making this a prompt-patch item rather than an active-incident emergency.
Command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 allows an authenticated remote attacker with low-privilege management credentials to execute arbitrary commands on the underlying operating system. Affected builds span the 8.10, 8.12, 8.13, 10.4, 10.7, and 10.8 branches as listed in the EUVD data. No public exploit was identified at time of analysis, and EPSS is low at 0.18%, so this is patch-worthy but not an emergency by the available signals.
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a remote attacker holding at least low-privileged credentials execute arbitrary commands on the underlying operating system, with high confidentiality, integrity and availability impact (CVSS 8.8). Affected branches include AOS-8 8.10.0.0 through 8.10.0.21, 8.12.0.0 through 8.12.0.6, 8.13.0.0 through 8.13.1.1, and AOS-10 10.4.0.0 through 10.4.1.10, 10.7.0.0 through 10.7.2.2, and 10.8.0.0. There is no confirmed active exploitation (SSVC exploitation: none) and no public exploit identified at time of analysis; EPSS is low at 0.18% (39th percentile), but the credential-only prerequisite plus total technical impact puts this on a this-week remediation cadence rather than an emergency one.
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated remote attacker with low privileges execute arbitrary commands on the underlying OS. Affected branches include AOS 8.10.0.0 through 8.10.0.21, 8.12.0.0 through 8.12.0.6, 8.13.0.0 through 8.13.1.1, 10.4.0.0 through 10.4.1.10, 10.7.0.0 through 10.7.2.2, and 10.8.0.0. EPSS is low at 0.18% (39th percentile), SSVC records exploitation as none, and no public exploit was identified at time of analysis; the vuln.today decision label is this_week.
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a low-privileged remote user to execute arbitrary commands on the underlying operating system, with full compromise of confidentiality, integrity and availability on the affected controller or gateway (CVSS 8.8, PR:L). Exploitation requires a valid authenticated session and network reachability of the management interface; no public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and automatable as no, and EPSS is low at 0.18% (39th percentile). Technical impact is rated total, so the issue is serious for any deployment whose management plane is reachable from untrusted networks, but it is not a drop-everything emergency given the credential prerequisite.
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote attacker who already holds high-privilege access to the web-based management interface to execute arbitrary operating-system commands on the controller/gateway. The flaw affects multiple AOS-8 (8.10.x-8.13.x) and AOS-10 (10.4.x-10.8.x) branches per HPE advisory hpesbnw05048en_us and carries CVSS 7.2 (High). There is no public exploit identified at time of analysis, EPSS is low (0.18%, 39th percentile), and CISA SSVC records exploitation status as none.
SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator inject crafted input into backend database queries reachable through the CLI and management protocol, ultimately achieving arbitrary command execution on the underlying OS of the wireless controller/gateway. Multiple 8.10.x, 8.12.x, 8.13.x, 10.4.x, 10.7.x and 10.8.0.0 releases are affected. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with the SSVC 'Exploitation: none' finding.
Arbitrary OS command execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) is achievable when an administratively-privileged operator injects crafted input into CLI and management-protocol parameters that reach backend database queries unsanitized. Multiple underlying service components are affected across the WLAN controller/gateway software family, and successful exploitation escalates from SQL injection to full command execution on the host OS. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%, 8th percentile), and CISA SSVC rates exploitation as none but technical impact as total.
SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator inject crafted input into unsanitized parameters within several backend service components reached via the CLI and management protocol, ultimately achieving arbitrary command execution on the underlying OS. It affects a broad range of AOS 8.10 through 8.13 and 10.4 through 10.8 releases and carries a CVSS 7.2 (High) rating. There is no public exploit identified at time of analysis, and EPSS is very low at 0.03%.
Command execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated administrator to inject SQL into several backend service components reachable via the CLI and management protocol, ultimately running arbitrary OS-level commands. The flaw affects multiple 8.x and 10.x AOS branches and carries CVSS 7.2; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 8th percentile). CISA's SSVC framework rates exploitation as none but technical impact as total, reflecting high potential damage if the high-privilege prerequisite is met.
SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator escalate to arbitrary OS command execution on the underlying controller/gateway by injecting crafted input through the CLI and management protocol into unsanitized backend database queries. Because exploitation demands existing administrative access (PR:H), it functions primarily as a privilege-boundary and integrity-escape issue rather than an initial-access vector, but the CVSS:3.1 base of 7.2 reflects total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, EPSS is very low (0.03%, 8th percentile), and CISA SSVC records exploitation as none.
Arbitrary code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated administrator to run code with elevated privileges on the underlying OS by sending crafted requests to management service components reached via the command-line interface. Multiple stack-based buffer overflows (CWE-121) underlie the issue, affecting AOS 8.10.x, 8.12.x, 8.13.x, 10.4.x, 10.7.x and 10.8.0.0. No public exploit identified at time of analysis, and EPSS is very low (0.07%, 22nd percentile), consistent with CISA SSVC scoring exploitation as 'none'.