Unauthenticated Traffic Handling Flaw Allows Packet Leakage on HPE Aruba Networking CX 10000 series switches (Hewlett Packard Enterprise (HPE) AOS-CX)
En bref
- Source
- NVD
- EPSS
- EPSS 0.24 % · centile 15 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- hpe
- Statut NVD
- Analyzed
Description
A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to conduct a packet forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leading to unauthorized data exposure.
Faiblesses (CWE)
- CWE-863 — Autorisation incorrecte
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | LOW 3.4 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N | hpe |
| CVSS 3.1 | LOW 3.4 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N | NVD · security-alert@hpe.com (Secondary) |
| CVSS 3.1 | LOW 3.4 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2024-52241
- GCVE · GCVE-0-2024-54010
Avis du CERT-FR
- CERTFR-2025-AVI-0017 — Vulnérabilité dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.10.0000 < 10.13.1070cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.14.0000 < 10.14.1030cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.15.0000 < 10.15.1000
Produits affectés
| Produit | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · AOS-CX | affected Version 10.10.0000: 10.10.1140 and below ≤ <=10.10.1140 ; affected Version 10.13.0000: 10.13.1060 and below ≤ <=10.13.1060 ; affected Version 10.14.0000: 10.14.1020 and below ≤ <=10.14.1020 ; affected Version 10.15.0000: 10.15.0005 and below ≤ <=10.15.0005 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |