Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative Access (Hewlett Packard Enterprise (HPE) ArubaOS (AOS))
En bref
- Source
- NVD
- EPSS
- EPSS 0.24 % · centile 16 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- hpe
- Statut NVD
- Awaiting Analysis
Description
Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data on affected devices.
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.3 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N | hpe |
| CVSS 3.1 | CRITICAL 9.3 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N | NVD · security-alert@hpe.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-108373
- GCVE · GCVE-0-2026-79873
Avis du CERT-FR
- CERTFR-2026-AVI-1369 — Multiples vulnérabilités dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · ArubaOS (AOS) | affected 10.8.0.0 ≤ 10.8.1.1 ; affected 10.7.0.0 ≤ 10.7.2.6 ; affected 10.4.0.0 ≤ 10.4.1.13 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |