Authenticated Session Hijacking Allows Unauthorized Access in Network Switching Software (Hewlett Packard Enterprise (HPE) HPE Aruba Networking AOS-CX)
En bref
- Source
- NVD
- EPSS
- EPSS 0.27 % · centile 20 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- hpe
- Statut NVD
- Analyzed
Description
A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active user session. Successful exploitation may enable the attacker to maintain unauthorized access to the session, potentially leading to the view or modification of sensitive configuration data.
Faiblesses (CWE)
- CWE-384 — Fixation de session
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.8 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N | hpe |
| CVSS 3.1 | MEDIUM 5.8 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N | NVD · security-alert@hpe.com (Secondary) |
| CVSS 3.1 | HIGH 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2025-198066
- GCVE · GCVE-0-2025-37159
Avis du CERT-FR
- CERTFR-2025-AVI-1021 — Multiples vulnérabilités dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.10.0000 < 10.10.1170cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.13.0000 < 10.13.1101cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.14.0000 < 10.14.1060cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.15.0000 < 10.15.1030cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.16.0000 < 10.16.1001
Produits affectés
| Produit | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · HPE Aruba Networking AOS-CX | affected 10.16.0000 ≤ 10.16.1000 ; affected 10.15.0000 ≤ 10.15.1020 ; affected 10.14.0000 ≤ 10.14.1050 ; affected 10.13.0000 ≤ 10.13.1090 ; affected 10.10.0000 ≤ 10.10.1160 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |