Insufficient Session Invalidation on User Account Deactivation in AOS-8 Operating System (Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS))
At a glance
- Source
- NVD
- EPSS
- EPSS 0.14 % · percentile 3 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hpe
- NVD status
- Analyzed
Description
A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated when credentials are revoked, enabling continued access until session expiration. An attacker with compromised credentials could exploit this behavior to maintain unauthorized access even after the account has been disabled.
Weaknesses (CWE)
- CWE-613 — DEPRECATED: Insufficient Session Expiration
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | hpe |
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | NVD · security-alert@hpe.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-29822
- GCVE · GCVE-0-2026-44873
CERT-FR advisories
- CERTFR-2026-AVI-0573 — Multiples vulnérabilités dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*≥ 6.5.4.0 < 8.10.0.22cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*≥ 8.11.0.0 < 8.12.0.7cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*≥ 8.13.0.0 < 8.13.1.2cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*≥ 8.6.0.4-2.2.0.0 ≤ 8.6.0.4-2.2.0.7cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*≥ 8.7.0.0-2.3.0.0 ≤ 8.7.0.0-2.3.0.9
Affected products
| Product | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · HPE Aruba Networking Wireless Operating System (AOS) | affected 8.13.0.0 ≤ 8.13.1.1 ; affected 8.12.0.0 ≤ 8.12.0.6 ; affected 8.10.0.0 ≤ 8.10.0.21 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |