Unauthenticated Traffic Handling Flaw Allows Packet Leakage on HPE Aruba Networking CX 10000 series switches (Hewlett Packard Enterprise (HPE) AOS-CX)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.24 % · percentile 15 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hpe
- NVD status
- Analyzed
Description
A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to conduct a packet forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leading to unauthorized data exposure.
Weaknesses (CWE)
- CWE-863 — Incorrect Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | LOW 3.4 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N | hpe |
| CVSS 3.1 | LOW 3.4 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N | NVD · security-alert@hpe.com (Secondary) |
| CVSS 3.1 | LOW 3.4 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-52241
- GCVE · GCVE-0-2024-54010
CERT-FR advisories
- CERTFR-2025-AVI-0017 — Vulnérabilité dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.10.0000 < 10.13.1070cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.14.0000 < 10.14.1030cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.15.0000 < 10.15.1000
Affected products
| Product | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · AOS-CX | affected Version 10.10.0000: 10.10.1140 and below ≤ <=10.10.1140 ; affected Version 10.13.0000: 10.13.1060 and below ≤ <=10.13.1060 ; affected Version 10.14.0000: 10.14.1020 and below ≤ <=10.14.1020 ; affected Version 10.15.0000: 10.15.0005 and below ≤ <=10.15.0005 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |