Authenticated Sensitive Information Disclosure exposes Credentials in AOS-CX Command Line Interface (Hewlett Packard Enterprise (HPE) AOS-CX)
En bref
- Source
- NVD
- EPSS
- EPSS 0.20 % · centile 9 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- hpe
- Statut NVD
- Deferred
Description
Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Successful exploitation could allow an attacker to gain unauthorized access to services outside of the impacted switch, potentially leading to lateral movement involving those services.
Faiblesses (CWE)
- CWE-359 — Exposure of Private Personal Information to an Unauthorized Actor
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.0 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N | hpe |
| CVSS 3.1 | MEDIUM 6.0 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N | NVD · security-alert@hpe.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2025-6700
- GCVE · GCVE-0-2025-27080
Avis du CERT-FR
- CERTFR-2025-AVI-0221 — Multiples vulnérabilités dans HPE Aruba Networking AOS-CX · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · AOS-CX | affected 10.10.0000 ≤ <=10.10.1140 ; affected 10.13.0000 ≤ <=10.13.1070 ; affected 10.14.0000 ≤ <=10.14.1030 ; affected 10.15.0000 ≤ <=10.15.1000 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |