Unauthenticated Remote Command Execution in Management Component (Hewlett Packard Enterprise (HPE) AOS-CX)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.47 % · percentile 41 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hpe
- NVD status
- Analyzed
Description
A vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Successful exploitation could result in remote execution of arbitrary commands in the context of the affected utility.
Weaknesses (CWE)
- CWE-77 — Improper Neutralization of Special Elements used in a Command
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L | hpe |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L | NVD · security-alert@hpe.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-69627
- GCVE · GCVE-0-2026-73763
CERT-FR advisories
- CERTFR-2026-AVI-1104 — Multiples vulnérabilités dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≤ 10.10.1180cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.13.0000 ≤ 10.13.1180cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.16.0000 ≤ 10.16.1051cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*≥ 10.17.0000 ≤ 10.17.1021cpe:2.3:o:hpe:arubaos-cx:10.18.0001:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · AOS-CX | affected 10.18.0000 ≤ 10.18.0001 ; affected 10.17.0000 ≤ 10.17.1021 ; affected 10.16.0000 ≤ 10.16.1051 ; affected 10.13.0000 ≤ 10.13.1180 ; affected 10.10.0000 ≤ 10.10.1180 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |