Vulnerability feed

Executive summary

An arbitrary file deletion flaw exists in the command line interface of AOS-10 products. The advisory says an attacker with administrative login could use it to crash the device, which would stop it from rebooting without manual intervention. The advisory does not state a vendor fix or recommended action.

Technical summary

The vulnerability class is arbitrary file deletion in the AOS-10 command line interface. The attacker must be authenticated with administrative privileges, and the advisory describes the impact as denial of service where the system crashes and cannot reboot without manual intervention. Affected versions, fixed versions, workarounds, and detection guidance are not stated in the advisory. The advisory text is truncated and does not state a CVSS score or whether exploitation has been observed.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

An authentication bypass in the PAPI protocol of AOS-10 lets an unauthenticated attacker on the same local network get around existing login controls. A successful attack can change certain settings on the affected system. The advisory does not state a severity score, and it does not describe a vendor fix or recommended action beyond the description given.

Technical summary

The flaw is an authentication bypass (CWE class not stated) in the PAPI protocol of AOS-10. The attacker must be adjacent to the target and needs no credentials. Successful exploitation lets the attacker change the state of certain settings on the vulnerable system. Affected versions, fixed versions, workarounds, CVSS score, exploitation status, and detection guidance are not stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

An unauthenticated command injection flaw affects the command line interface of AOS-10 products. The advisory says a successful attacker with physical access could run arbitrary commands as a privileged user, leading to complete system compromise.

Technical summary

The vulnerability is a command injection issue in the AOS-10 command line interface that requires no authentication. The advisory states the attack requires physical access to the device and results in arbitrary command execution as a privileged user on the underlying operating system. Affected and fixed version numbers are not stated. No workaround is stated. No detection guidance is stated. Exploitation in the wild and any CVSS score are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Physical

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

A buffer overflow in the API of AOS-10 could let an attacker who already has high-level access and is on the local network run code on the underlying system. The advisory describes the seriousness as high impact but does not state a numeric severity score, and it does not describe a vendor-recommended fix in the text provided.

Technical summary

The flaw is a buffer overflow in the AOS-10 API that can lead to remote code execution as a privileged user on the underlying operating system. The attack requires authentication with high privileges and an adjacent network position, and the advisory does not describe any other preconditions. Affected and fixed version numbers are not stated, no workaround is stated, and no detection guidance is provided. Exploitation in the wild and a CVSS score are also not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

An authentication bypass flaw in the web-based management interface of AOS-10 is reported in this advisory. An unauthenticated attacker on an adjacent network could potentially run arbitrary commands on the underlying host, but only if certain preconditions outside the attacker's control are met. The advisory does not state a severity rating or a vendor-recommended fix.

Technical summary

The vulnerability is an authentication bypass in the web-based management interface of AOS-10, allowing an unauthenticated adjacent attacker to circumvent authentication controls and execute arbitrary commands on the underlying operating system. Exploitation depends on preconditions that the advisory says are outside the attacker's control, and those preconditions are not specified. Affected versions are not stated, fixed versions are not stated, and no workaround is stated. No CVSS score, exploitation-in-the-wild status, or detection guidance is stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

High

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

A buffer overflow in the underlying operating system of Alcatel-Lucent Enterprise AOS-10 and AOS-8 products could let a nearby attacker who needs no login disrupt the affected device. The advisory does not state a severity score, and it does not name a fix or version list in the text provided.

Technical summary

The flaw is a buffer overflow in the underlying operating system of AOS-10 or AOS-8, reachable without authentication by an adjacent attacker. The advisory says exploitation could cause denial of service, with availability impacted and limited integrity impact. Affected versions, fixed versions, workarounds, and CVSS score are not stated in the advisory text provided. Exploitation status in the wild and detection guidance are also not stated. The advisory text appears truncated, so some details may be missing from this copy.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

Command injection flaws exist in an interface of AOS-10 that let an authenticated attacker with high privileges run commands on the underlying operating system. The advisory does not state a severity score, and it does not describe a fix or workaround.

Technical summary

The vulnerability class is command injection (OS command execution through unsanitized input) in an unspecified interface of AOS-10. Exploitation requires remote network access and an authenticated account with high privileges, and successful exploitation executes arbitrary commands as a privileged user on the underlying operating system. The advisory does not state affected or fixed version numbers, a CVSS score, workarounds, or detection guidance, and it does not say whether exploitation has been observed in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

Command injection flaws exist in an interface of AOS-10, a product from Alcatel-Lucent Enterprise (the advisory names AOS-10 only). An attacker who already holds high privileges on the device could run arbitrary commands on the underlying operating system. The advisory does not state a severity rating or a vendor-recommended fix.

Technical summary

The vulnerability class is command injection (CWE not stated). The attack requires a remote, authenticated user with high privileges, and successful exploitation would let the attacker run arbitrary commands as a privileged user on the operating system. Affected versions are not stated, fixed versions are not stated, no workaround is stated, and no detection guidance is stated. No CVSS score is stated, and the advisory does not say whether the flaw is exploited in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

A flaw in an interface of AOS-10 could let an unauthenticated remote attacker cause a denial of service, disrupting the availability of that interface. The advisory does not state a severity score for this issue. The advisory does not state a fix or recommended action.

Technical summary

The advisory describes a denial of service vulnerability in the affected interface of AOS-10, reachable by an unauthenticated remote attacker. Successful exploitation would disrupt availability of that interface. The specific vulnerability class, the affected interface name, and the affected AOS-10 versions are not stated. Fixed versions, workarounds, CVSS score, and detection guidance are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to cause a denial of service. Successful exploitation could disrupt the availability of the affected service. The advisory does not state a severity score or a fix.

Technical summary

The advisory describes memory corruption vulnerabilities in AOS-10 that can be triggered by an unauthenticated remote attacker, leading to denial of service. The vulnerability class is memory corruption, and the advisory does not give specific details of the vulnerable component. Affected AOS-10 versions are not stated. Fixed versions are not stated. Workarounds are not stated. Detection guidance and CVSS score are not stated, and exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

The advisory says memory corruption flaws in an interface of AOS-10 could let an unauthenticated attacker on the same local network run arbitrary code on the affected system. It describes the impact as allowing code to run with privileged access to the underlying operating system. The advisory does not state a severity score or the vendor's specific remediation steps.

Technical summary

The flaw class is memory corruption in an unspecified interface of AOS-10, leading to remote code execution. The attack vector is adjacent network access, and no authentication is required. Successful exploitation is described as allowing arbitrary code execution as a privileged user on the underlying operating system. Affected versions, fixed versions, workarounds, CVSS score, and detection guidance are not stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

A remote code execution flaw affects the underlying operating system of AOS-10, a networking product line. An unauthenticated attacker on an adjacent network could run arbitrary code on an affected device and fully take it over. The advisory does not state a severity score, and it does not describe a vendor fix or workaround in the text provided.

Technical summary

The advisory describes a remote code execution vulnerability in the underlying operating system of AOS-10, with the attacker able to run arbitrary commands as a privileged user. The attack vector is adjacent network access and no authentication is required, per the advisory. Affected and fixed versions are not stated in the text provided. No workaround or mitigation is stated. No detection guidance or CVSS score is stated, and exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

An authentication bypass in the API of AOS-10 lets a nearby attacker who is not logged in get past existing access controls. The advisory says successful exploitation could grant administrative access, allow system configuration changes, and expose or alter sensitive data. The advisory does not state a severity rating or a vendor fix recommendation.

Technical summary

The flaw is an authentication bypass in the AOS-10 API, reachable by an unauthenticated adjacent attacker, meaning the attacker must be on a neighboring network segment rather than remote over the internet. The advisory does not state the affected or fixed AOS-10 versions, a CVSS score, or any workaround. It also does not say whether exploitation has been observed in the wild, and it gives no detection guidance. Engineers should check the vendor's own advisory for version ranges and remediation before acting.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

Authentication bypass flaws in the PAPI protocol of AOS-10 could let an unauthenticated attacker on the same local network get past login controls. The advisory says a successful attack could grant administrative access, allow system configuration changes, and expose or alter sensitive data. The advisory does not state a severity score, and it does not describe a vendor fix or workaround in the text provided.

Technical summary

The flaw is an authentication bypass in the PAPI protocol of AOS-10, which requires no prior authentication and an adjacent network position. The advisory does not state the CVSS score, the specific affected AOS-10 versions, or any fixed versions. No workaround or mitigation is stated. No detection guidance or indicators of compromise are stated, and no information on exploitation in the wild is given.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

A flaw in the command line interface of AOS-10 could let an unauthenticated remote attacker access sensitive information. The attacker could use that information to potentially gain further access to network services supported by AOS-10. The advisory does not state a severity rating or a fix.

Technical summary

This is a sensitive information disclosure vulnerability in the AOS-10 command line interface, reachable by an unauthenticated remote attacker. The advisory does not state the exact attack steps or preconditions beyond remote unauthenticated access. Successful exploitation could expose information usable to gain further access to network services supported by AOS-10. Affected versions, fixed versions, workarounds, CVSS score, and detection guidance are not stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

Authentication bypass flaws in an interface of AOS-10 could let an unauthenticated attacker on the local network get around login controls. Successful exploitation could allow running arbitrary commands as a privileged user on the underlying operating system. The advisory does not state a severity score or specific fixed release, so check the vendor's guidance for patch details.

Technical summary

The flaws are authentication bypass vulnerabilities in an affected interface of AOS-10. The attacker must be unauthenticated and adjacent to the target, and the advisory does not describe other preconditions. Successful exploitation could allow arbitrary command execution as a privileged user on the underlying operating system. Affected and fixed versions are not stated, no CVSS score is stated, and no workarounds or detection guidance are stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

A memory corruption flaw in the AOS-10 product could let an unauthenticated attacker on the same local network run code on affected devices. The advisory describes the severity as remote code execution with privileged access to the underlying operating system, but it does not state a CVSS score. The advisory does not describe a vendor fix or recommended action beyond the vulnerability description.

Technical summary

The advisory describes a memory corruption vulnerability in an unnamed affected interface of AOS-10, which is the vulnerability class. It requires no authentication and an adjacent attacker, so the attacker must be on the same network segment, and successful exploitation could allow arbitrary code execution as a privileged user on the underlying operating system. Affected and fixed version numbers are not stated, and no workaround is stated. No detection guidance, exploitation status in the wild, or CVSS score is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

Command injection vulnerabilities exist in the affected interface of AOS-10. An unauthenticated attacker on an adjacent network could exploit them to run arbitrary commands with privileged access on the underlying operating system.

Technical summary

The advisory describes command injection vulnerabilities in an unspecified interface of AOS-10. The attack vector is adjacent, and no authentication is required. Successful exploitation would allow arbitrary command execution as a privileged user on the underlying operating system. Affected versions are not stated. Fixed versions are not stated. Workarounds are not stated. Detection guidance is not stated. The advisory does not give a CVSS score or say whether exploitation in the wild has occurred.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

Buffer overflow flaws in the AOS-10 and AOS-8 products could let an unauthenticated attacker on the same local network run arbitrary code on the affected device. The advisory says successful exploitation could give the attacker privileged control of the underlying operating system.

Technical summary

The advisory describes buffer overflow vulnerabilities in an unspecified affected interface of AOS-10 and AOS-8. Exploitation requires an adjacent attacker who sends specially crafted data to that interface, and no authentication is needed. Successful exploitation could allow arbitrary code execution as a privileged user on the underlying operating system. Affected version numbers are not stated, fixed versions are not stated, workarounds are not stated, and detection guidance is not stated. The advisory text also appears truncated in its opening sentence.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

A command injection flaw in AOS-10 could let an unauthenticated attacker run arbitrary code on affected devices by sending specially crafted PAPI packets. The advisory describes the result as code execution with privileged access to the underlying operating system. The advisory does not state a severity score or the vendor's recommended fix.

Technical summary

The flaw is a command injection vulnerability in AOS-10, reachable by sending specially crafted PAPI packets. No authentication is required, according to the advisory, and successful exploitation gives arbitrary code execution as a privileged user on the underlying operating system. Affected AOS-10 versions are not stated. Fixed versions are not stated. Workarounds are not stated. Detection guidance is not stated, and no CVSS score is given.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

A flaw in the AOS-10 product could let an unauthenticated remote attacker run database injection attacks against an AOS-10 instance. The advisory says successful exploitation could allow arbitrary commands to run on the underlying operating system, which is a serious outcome, and it does not state a severity score or the vendor's recommended fix.

Technical summary

The vulnerability is classified as SQL injection in an unspecified interface of AOS-10. The advisory states that an unauthenticated remote attacker can exploit it, so no login is required. Successful exploitation could allow execution of arbitrary operating system commands. Affected and fixed version numbers are not stated, no workaround is stated, and no detection guidance or indicators of compromise are stated. The specific interface affected is not named, and no CVSS score or exploitation status is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

Sensitive information disclosure vulnerabilities affect the AOS-10 product. The advisory says an unauthenticated remote attacker could obtain sensitive information from the affected system, and that successful exploitation could allow arbitrary command execution on the underlying operating system.

Technical summary

The advisory describes sensitive information disclosure flaws in an unspecified interface of AOS-10, exploitable remotely by an unauthenticated attacker. It states that successful exploitation could allow arbitrary command execution on the underlying operating system. Affected versions are not stated, fixed versions are not stated, and no workaround is stated. No detection guidance, CVSS score, or information about exploitation in the wild is stated. The advisory text is truncated, so the affected interface and any further details may be missing.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

Buffer overflow vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary code. The advisory says successful exploitation could give an attacker privileged control of the underlying operating system and complete system compromise.

Technical summary

The advisory describes buffer overflow vulnerabilities in an unspecified interface of AOS-10, which can lead to unauthenticated remote code execution as a privileged user. The attack vector is described as remote and requires no authentication, but the specific interface and any other preconditions are not stated. Affected AOS-10 versions are not stated, and fixed versions are not stated. No workarounds, mitigations, CVSS score, or detection guidance are stated in the advisory. Exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

A buffer overflow in an interface of AOS-10 allows an unauthenticated attacker to run arbitrary code with privileged access on the underlying operating system. The advisory does not give a severity score, and it does not state a fix or recommended action beyond the description of the flaw.

Technical summary

The flaw is a buffer overflow in the affected interface of AOS-10, reachable by sending specially crafted packets to that interface. No authentication is required, and successful exploitation gives arbitrary code execution as a privileged user on the underlying operating system. The advisory does not state affected or fixed version numbers, a CVSS score, workarounds, or detection guidance, and it does not say whether exploitation in the wild has been observed. The specific interface name is also not stated in the excerpt provided.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

Authentication bypass vulnerabilities in the AOS-10 management interface could let an unauthenticated remote attacker run commands on the underlying host. The advisory says exploitation requires certain preconditions outside the attacker's control to be met.

Technical summary

The flaws are authentication bypass issues in an affected interface of AOS-10, which could lead to arbitrary command execution on the underlying operating system. The attack is remote and requires no authentication, but only if preconditions outside the attacker's control are met; the advisory does not describe those preconditions. The advisory does not state affected or fixed version numbers, a CVSS score, workarounds, mitigations, exploitation status, or detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10