Authenticated Sensitive Information Disclosure exposes Credentials in AOS-CX Command Line Interface (Hewlett Packard Enterprise (HPE) AOS-CX)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.20 % · percentile 9 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hpe
- NVD status
- Deferred
Description
Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Successful exploitation could allow an attacker to gain unauthorized access to services outside of the impacted switch, potentially leading to lateral movement involving those services.
Weaknesses (CWE)
- CWE-359 — Exposure of Private Personal Information to an Unauthorized Actor
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.0 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N | hpe |
| CVSS 3.1 | MEDIUM 6.0 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N | NVD · security-alert@hpe.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-6700
- GCVE · GCVE-0-2025-27080
CERT-FR advisories
- CERTFR-2025-AVI-0221 — Multiples vulnérabilités dans HPE Aruba Networking AOS-CX · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · AOS-CX | affected 10.10.0000 ≤ <=10.10.1140 ; affected 10.13.0000 ≤ <=10.13.1070 ; affected 10.14.0000 ≤ <=10.14.1030 ; affected 10.15.0000 ≤ <=10.15.1000 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |