Vulnerability feed

Executive summary

A memory corruption flaw affects the web-based management interface of AOS-8 products. The advisory says an authenticated, low-privilege attacker with local access could view some system files and disrupt the normal operation of the affected service.

Technical summary

The flaw is a memory corruption vulnerability in the web-based management interface of AOS-8. Exploitation requires an authenticated low-privilege attacker with local access. The advisory says successful exploitation could expose some system files and interrupt the affected service. Affected versions are not stated, and no fixed version is stated. No workaround is stated. No detection guidance is stated. No CVSS score is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

High

Privileges required

Low

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

A buffer overflow flaw in AOS-8 software lets a logged-in attacker with administrator rights crash the system, causing a denial of service. The advisory says a crash could leave the device unable to reboot without manual intervention, disrupting network operations. The advisory does not state a severity score or a vendor fix recommendation.

Technical summary

The flaw is a buffer overflow (CWE class not stated) in AOS-8. Exploitation requires an authenticated attacker with administrative access, and the advisory describes the impact as a system crash that prevents reboot without manual intervention. Affected AOS-8 versions are not stated, and fixed versions are not stated. Workarounds are not stated. Detection guidance is not stated. CVSS score and exploitation status in the wild are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

An authentication bypass flaw in the PAPI protocol of AOS-8 lets an unauthenticated remote attacker get around existing login controls. The advisory says successful exploitation allows limited unauthorized changes to certain settings on the affected system. The advisory does not state a severity rating or a vendor-recommended fix.

Technical summary

The flaw is an authentication bypass in the PAPI protocol of AOS-8, reachable remotely by an unauthenticated attacker. Successful exploitation allows limited unauthorized modification of certain settings. The advisory does not state affected or fixed version numbers, a CVSS score, workarounds, or detection guidance, and it does not say whether exploitation in the wild has been observed. Defenders should check the vendor's bulletin for version details and mitigations.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

An unauthenticated buffer overflow in the command line interface of AOS-8 could let a remote attacker disrupt the affected interface and access or change some system data. The advisory does not state a severity rating or a score. The advisory does not state what the vendor recommends.

Technical summary

The flaw is a buffer overflow in the command line interface of AOS-8 that requires no authentication. The advisory says a remote unauthenticated attacker could disrupt availability of the affected interface and gain limited access to or modification of some system data. Affected versions are not stated, and no fixed version is stated. No workaround is stated. No CVSS score, exploitation status, or detection guidance is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

A flaw in the PAPI protocol of Alcatel-Lucent Enterprise AOS-8 network software could let an unauthenticated attacker on the same network segment view some limited information and disrupt the affected service. The advisory does not state a severity rating or a score. The advisory does not describe a vendor fix or recommended action in the text provided.

Technical summary

The advisory describes a sensitive information disclosure vulnerability in the PAPI protocol of AOS-8, reachable by an unauthenticated adjacent attacker, which could also affect service availability. No CVSS score or severity rating is stated. Affected and fixed version numbers are not stated. Workarounds and mitigations are not stated. Detection guidance and indicators of compromise are not stated. The advisory text is truncated, so further details may be missing.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

A buffer overflow in the underlying operating system of Alcatel-Lucent Enterprise AOS-10 and AOS-8 products could let a nearby attacker who needs no login disrupt the affected device. The advisory does not state a severity score, and it does not name a fix or version list in the text provided.

Technical summary

The flaw is a buffer overflow in the underlying operating system of AOS-10 or AOS-8, reachable without authentication by an adjacent attacker. The advisory says exploitation could cause denial of service, with availability impacted and limited integrity impact. Affected versions, fixed versions, workarounds, and CVSS score are not stated in the advisory text provided. Exploitation status in the wild and detection guidance are also not stated. The advisory text appears truncated, so some details may be missing from this copy.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

A buffer overflow in the PAPI protocol of AOS-8 may let a logged-in attacker with high privileges run code remotely on the affected system. The advisory does not state a severity score, and it does not describe a fix or workaround.

Technical summary

The flaw is a buffer overflow in the PAPI protocol of AOS-8, which can lead to remote code execution as a privileged user on the underlying operating system. Exploitation requires an authenticated attacker with high privileges and network access to the protocol. Affected and fixed version numbers are not stated. Workarounds, mitigations, and detection guidance are not stated. A CVSS score is not stated, and exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

Command injection vulnerabilities in the AOS-8 product's affected interface have been reported. The advisory says an attacker who is already authenticated with high privileges could run commands on the underlying operating system.

Technical summary

The flaw is classified as command injection, which allows crafted input to be interpreted as operating system commands. The attack vector is remote, but the attacker must be authenticated with high privileges. Commands run with the privileges of the impacted mechanism on the underlying operating system. The advisory does not state affected versions, fixed versions, workarounds, exploitation in the wild, a CVSS score, or detection guidance. The specific affected interface is not named in the text provided.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

Command injection flaws in an interface of AOS-8 could let a logged-in remote attacker with high privileges run commands on the underlying system. The advisory does not state a severity rating or a fix for the issue.

Technical summary

The advisory describes command injection vulnerabilities in the affected interface of AOS-8. Exploitation requires a remote attacker who is authenticated and holds high privileges. Successful exploitation would let the attacker execute commands with the privileges of the impacted mechanism on the underlying operating system. Affected versions, fixed versions, workarounds, CVSS score, and detection guidance are not stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

A flaw in the command-line handling of the AOS-8 web interface may let a logged-in remote attacker run unauthorized commands on the underlying operating system. The advisory says successful exploitation could lead to full system compromise. The advisory does not state a severity rating or a vendor fix.

Technical summary

The advisory describes a command injection vulnerability in the CLI command handling of the AOS-8 web interface, which allows arbitrary operating system command execution. The attack requires an authenticated remote attacker, so valid credentials are a precondition. Affected versions, fixed versions, workarounds, CVSS score, and detection guidance are not stated in the advisory text provided.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

An unauthenticated memory corruption flaw exists in a service reached through the PAPI protocol in AOS-8. The advisory says a remote attacker without credentials could use it to cause a denial of service and disrupt the affected service. The advisory text provided does not state a severity rating or a vendor fix recommendation.

Technical summary

The flaw is a memory corruption vulnerability in a service accessed via the PAPI protocol in AOS-8, and it requires no authentication. A remote attacker could exploit it to cause a denial of service. The advisory text is truncated, and it does not state affected versions, fixed versions, workarounds, CVSS score, or detection guidance. Exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

An unauthenticated denial-of-service flaw exists in the PAPI protocol of AOS-8, a product line that the advisory names but does not describe further. A successful attack can disrupt the availability of the affected interface. The advisory does not state a severity rating or any vendor fix or recommendation.

Technical summary

The flaw is classified as a denial-of-service vulnerability in the PAPI protocol of AOS-8 and can be triggered without authentication. Successful exploitation disrupts availability of the affected interface. The advisory does not state the attack vector, required network position, affected or fixed version numbers, workarounds, or any detection guidance. It also does not state whether exploitation has been observed in the wild or give a CVSS score.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

A memory corruption flaw affects AOS-8 software. The advisory says an attacker who already has a local login could run arbitrary code with privileged access on the underlying operating system. The advisory does not state a severity rating or a vendor-recommended fix.

Technical summary

The flaw is a memory corruption vulnerability in AOS-8. The attack requires an authenticated local attacker, and successful exploitation could allow arbitrary code execution as a privileged user on the underlying operating system. Affected and fixed versions are not stated in the advisory. A CVSS score is not stated. Workarounds and detection guidance are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

Command injection flaws in AOS-8 could let an unauthenticated attacker run arbitrary code on affected systems by sending specially crafted PAPI packets. The advisory says successful exploitation gives code execution as a privileged user on the underlying operating system. The advisory does not state a severity score or the vendor's recommended fix.

Technical summary

The vulnerability class is command injection, reachable remotely over the PAPI protocol without authentication. An attacker needs only the ability to send crafted PAPI packets to the device, and successful exploitation yields arbitrary code execution as a privileged user on the underlying operating system. Affected versions, fixed versions, workarounds, and detection guidance are not stated in the advisory. No CVSS score or evidence of exploitation in the wild is stated either.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

Multiple web interface endpoints on AOS-8 devices contain flaws that an unauthenticated remote attacker could abuse to fully compromise the device. The advisory rates the impact as complete system compromise, but it does not state a severity score. Remediation guidance, including any fixed version, is not stated in the advisory text provided.

Technical summary

The flaw is a buffer overflow in multiple web interface endpoints, triggered by specially crafted requests sent over the network. No authentication is required, so the attacker needs only network reach to the web interface. Successful exploitation could allow arbitrary command execution on the underlying operating system. Affected and fixed versions are not stated, no workaround is stated, and no detection guidance is stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

A flaw in a web interface endpoint of AOS-8 devices could let an unauthenticated remote attacker take complete control of the affected system. The advisory does not state a severity rating or score.

Technical summary

The vulnerability is a buffer overflow in a certain web interface endpoint of AOS-8 devices. The advisory states it can be triggered by an unauthenticated remote attacker, and successful exploitation could allow arbitrary command execution on the underlying operating system. Affected versions are not stated, fixed versions are not stated, and no workaround is stated. No detection guidance, CVSS score, or information on exploitation in the wild is provided.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

A flaw in the web interface of AOS-8 could let an unauthenticated remote attacker run code on affected devices. The advisory says successful exploitation could give full control of the device, allowing network traffic interception and possible compromise of connected systems. The advisory does not state a severity score or the specific vendor recommendation.

Technical summary

The vulnerability is described as enabling remote code execution through the web interface of AOS-8, reachable by an unauthenticated remote attacker. The advisory does not state the specific weakness class, the exact preconditions beyond unauthenticated network access, or the affected version numbers. Fixed versions are not stated. Workarounds are not stated. Detection guidance is not stated, and there is no indication of exploitation in the wild or a CVSS score in the advisory text.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

An unauthenticated buffer overflow in the PAPI protocol of AOS-8 may let a remote attacker disrupt a service on the affected controller without logging in. The advisory says the impact is availability disruption with limited integrity impact. The advisory does not state a severity score or the vendor's recommended fix.

Technical summary

The flaw is a buffer overflow in the PAPI protocol of AOS-8, reachable without authentication. A remote attacker who can reach the PAPI service may exploit it to disrupt availability of that service on the controller, with limited integrity impact. Affected versions, fixed versions, workarounds, and detection guidance are not stated in the advisory. A CVSS score is not stated, and whether exploitation in the wild has occurred is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

An unauthenticated file write flaw exists in the PAPI protocol in AOS-8. The advisory says a remote attacker could make limited changes to files on affected systems and disrupt the availability of the affected service.

Technical summary

The flaw is an unauthenticated file write vulnerability in the PAPI protocol in AOS-8, per the advisory. Exploitation requires no authentication and can be performed remotely. Successful exploitation allows limited modification of files and disruption of service availability. The advisory does not state affected or fixed version numbers, a CVSS score, workarounds, or detection guidance, and does not state whether exploitation in the wild has occurred.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8 PAPI protocol

Executive summary

A flaw in the web-based management interface of AOS-8 could let an unauthenticated attacker on the same local network bypass login controls and read sensitive information. The advisory says some data could be exposed in cleartext, which could help an attacker further compromise other network infrastructure.

Technical summary

The advisory describes an authentication bypass in the web-based management interface of AOS-8, exploitable by an unauthenticated adjacent attacker. Successful exploitation exposes some data in cleartext and could enable further compromise of other network infrastructure. The advisory text is truncated, so the affected AOS-8 versions, fixed versions, workarounds, CVSS score, and detection guidance are not stated. Exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

An authentication bypass flaw affects the underlying operating system of AOS-8. An unauthenticated remote attacker could use it to get past existing login controls and potentially take complete control of the system. The advisory does not state a severity score or a vendor fix.

Technical summary

The flaw is an authentication bypass in the underlying operating system of AOS-8, exploitable remotely by an unauthenticated attacker. The advisory says successful exploitation could allow arbitrary code execution as a privileged user, leading to complete system compromise. Affected versions are not stated. Fixed versions are not stated. Workarounds are not stated. Detection guidance is not stated. No CVSS score is given.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

Required

Scope

Changed

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

A flaw in the command line interface of AOS-8 could let a logged-in remote attacker with high privileges make the device send requests on their behalf to internal targets. The advisory says successful exploitation could also allow arbitrary commands to run on the underlying operating system. The advisory does not state a remediation recommendation or fixed version.

Technical summary

The vulnerability is a server-side request forgery (SSRF) in the AOS-8 command line interface. Exploitation requires an authenticated remote attacker with high privileges. The advisory states that successful exploitation could allow execution of arbitrary commands on the underlying operating system. Affected versions are not stated, fixed versions are not stated, and no workaround is stated. No detection guidance is stated, and no CVSS score or exploitation status is given.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Changed

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

A command injection flaw in the AOS-8 command line interface, reached through the PAPI protocol, could let an unauthenticated attacker on an adjacent network run arbitrary code on the affected device. The advisory describes the impact as code execution with privileged operating system access. The advisory text provided does not state a severity rating or the vendor's specific fix recommendation.

Technical summary

The flaw is a command injection vulnerability in the AOS-8 command line interface accessed via the PAPI protocol. An adjacent attacker can exploit it without authentication by sending specially crafted PAPI packets to UDP port 8211. Successful exploitation allows arbitrary code execution as a privileged user on the underlying operating system. Affected and fixed version numbers are not stated in the advisory text. A CVSS score is not stated. Workarounds and detection guidance are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

A flaw in the PAPI protocol of AOS-8 may let an unauthenticated attacker on the same local network bypass authentication controls. The advisory says successful exploitation could grant administrative access, allow system configuration changes, and expose or alter sensitive data. Severity rating and vendor fix guidance are not stated in the advisory text provided.

Technical summary

The vulnerability is an authentication bypass in the PAPI protocol of AOS-8, exploitable by an unauthenticated adjacent attacker. The advisory does not state affected versions, fixed versions, a CVSS score, or a workaround. No detection guidance or evidence of in-the-wild exploitation is stated. The advisory does not specify the exact preconditions beyond adjacent network access and the absence of authentication.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

An authentication bypass flaw in the PAPI protocol of AOS-8 lets a nearby attacker with no credentials get past login controls. The advisory says successful exploitation could grant administrative access, change configurations, expose or alter sensitive data, and disrupt network operations.

Technical summary

The flaw is an authentication bypass in the PAPI protocol of AOS-8, exploitable by an unauthenticated attacker on an adjacent network. The advisory does not state a CVSS score, affected or fixed version numbers, workarounds, or whether exploitation has been observed in the wild. No detection guidance is stated. Defenders should check vendor documentation for patch versions and restrict PAPI access to trusted adjacent hosts while awaiting guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8