Insufficient Session Invalidation on User Account Deactivation in AOS-8 Operating System (Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS))
En bref
- Source
- NVD
- EPSS
- EPSS 0.14 % · centile 3 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- hpe
- Statut NVD
- Analyzed
Description
A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated when credentials are revoked, enabling continued access until session expiration. An attacker with compromised credentials could exploit this behavior to maintain unauthorized access even after the account has been disabled.
Faiblesses (CWE)
- CWE-613 — Expiration de session insuffisante
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | hpe |
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | NVD · security-alert@hpe.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-29822
- GCVE · GCVE-0-2026-44873
Avis du CERT-FR
- CERTFR-2026-AVI-0573 — Multiples vulnérabilités dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*≥ 6.5.4.0 < 8.10.0.22cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*≥ 8.11.0.0 < 8.12.0.7cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*≥ 8.13.0.0 < 8.13.1.2cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*≥ 8.6.0.4-2.2.0.0 ≤ 8.6.0.4-2.2.0.7cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*≥ 8.7.0.0-2.3.0.0 ≤ 8.7.0.0-2.3.0.9
Produits affectés
| Produit | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · HPE Aruba Networking Wireless Operating System (AOS) | affected 8.13.0.0 ≤ 8.13.1.1 ; affected 8.12.0.0 ≤ 8.12.0.6 ; affected 8.10.0.0 ≤ 8.10.0.21 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |