Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI Protocol (Hewlett Packard Enterprise (HPE) ArubaOS (AOS))
En bref
- Source
- NVD
- EPSS
- EPSS 0.24 % · centile 15 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- hpe
- Statut NVD
- Awaiting Analysis
Rechercher sur…
Description
A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service. Successful exploitation could allow an attacker to view some information and to disrupt the availability of the affected service.
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H | hpe |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H | NVD · security-alert@hpe.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-108406
- GCVE · GCVE-0-2026-95712
Avis du CERT-FR
- CERTFR-2026-AVI-1369 — Multiples vulnérabilités dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · ArubaOS (AOS) | affected 8.13.0.0 ≤ 8.13.3.0 ; affected 8.10.0.0 ≤ 8.10.0.23 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |