Authenticated Access Control Vulnerability allows Sensitive Information Disclosure in AOS-CX REST Interface (Hewlett Packard Enterprise (HPE) AOS-CX)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.35 % · percentile 29 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hpe
- NVD status
- Deferred
Description
A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation could allow an attacker to read encrypted credentials of other users on the switch, potentially leading to further unauthorized access or data breaches.
Weaknesses (CWE)
- CWE-359 — Exposure of Private Personal Information to an Unauthorized Actor
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | hpe |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · security-alert@hpe.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-6701
- GCVE · GCVE-0-2025-25042
CERT-FR advisories
- CERTFR-2025-AVI-0221 — Multiples vulnérabilités dans HPE Aruba Networking AOS-CX · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · AOS-CX | affected 10.10.0000 ≤ <=10.10.1140 ; affected 10.13.0000 ≤ <=10.13.1070 ; affected 10.14.0000 ≤ <=10.14.1030 ; affected 10.15.0000 ≤ <=10.15.1000 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |