Authenticated Access Control Vulnerability allows Sensitive Information Disclosure in AOS-CX REST Interface (Hewlett Packard Enterprise (HPE) AOS-CX)
En bref
- Source
- NVD
- EPSS
- EPSS 0.35 % · centile 29 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- hpe
- Statut NVD
- Deferred
Description
A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation could allow an attacker to read encrypted credentials of other users on the switch, potentially leading to further unauthorized access or data breaches.
Faiblesses (CWE)
- CWE-359 — Exposure of Private Personal Information to an Unauthorized Actor
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | hpe |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · security-alert@hpe.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2025-6701
- GCVE · GCVE-0-2025-25042
Avis du CERT-FR
- CERTFR-2025-AVI-0221 — Multiples vulnérabilités dans HPE Aruba Networking AOS-CX · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · AOS-CX | affected 10.10.0000 ≤ <=10.10.1140 ; affected 10.13.0000 ≤ <=10.13.1070 ; affected 10.14.0000 ≤ <=10.14.1030 ; affected 10.15.0000 ≤ <=10.15.1000 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |