Authenticated Arbitrary File Download via AOS-10 Web-Based Management Interface (Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS))
En bref
- Source
- NVD
- EPSS
- EPSS 0.30 % · centile 23 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- hpe
- Statut NVD
- Analyzed
Description
A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files on the underlying operating system. Successful exploitation of this vulnerability could result in the disclosure of confidential system information, potentially enabling further attacks against the affected device.
Faiblesses (CWE)
- CWE-284 — Contrôle d'accès incorrect
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | hpe |
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | NVD · security-alert@hpe.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-29823
- GCVE · GCVE-0-2026-44874
Avis du CERT-FR
- CERTFR-2026-AVI-0573 — Multiples vulnérabilités dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*≥ 10.4.0.0 < 10.4.1.11cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*≥ 10.5.0.0 < 10.7.2.3cpe:2.3:o:arubanetworks:arubaos:10.8.0.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · HPE Aruba Networking Wireless Operating System (AOS) | affected 10.7.0.0 ≤ 10.7.2.2 ; affected 10.8.0.0 ; affected 10.4.0.0 ≤ 10.4.1.10 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |