Authenticated Session Hijacking Allows Unauthorized Access in Network Switching Software (Hewlett Packard Enterprise (HPE) HPE Aruba Networking AOS-CX)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.27 % · percentile 20 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hpe
- NVD status
- Analyzed
Description
A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active user session. Successful exploitation may enable the attacker to maintain unauthorized access to the session, potentially leading to the view or modification of sensitive configuration data.
Weaknesses (CWE)
- CWE-384 — Session Fixation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.8 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N | hpe |
| CVSS 3.1 | MEDIUM 5.8 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N | NVD · security-alert@hpe.com (Secondary) |
| CVSS 3.1 | HIGH 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-198066
- GCVE · GCVE-0-2025-37159
CERT-FR advisories
- CERTFR-2025-AVI-1021 — Multiples vulnérabilités dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.10.0000 < 10.10.1170cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.13.0000 < 10.13.1101cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.14.0000 < 10.14.1060cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.15.0000 < 10.15.1030cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.16.0000 < 10.16.1001
Affected products
| Product | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · HPE Aruba Networking AOS-CX | affected 10.16.0000 ≤ 10.16.1000 ; affected 10.15.0000 ≤ 10.15.1020 ; affected 10.14.0000 ≤ 10.14.1050 ; affected 10.13.0000 ≤ 10.13.1090 ; affected 10.10.0000 ≤ 10.10.1160 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |