Description
Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code execution with elevated privileges.
Affected products
hpe: arubaos-cx; hpe: aruba cx 10000-48y6c \(r8p13a\); hpe: aruba cx 10000-48y6c \(r8p14a\); hpe: aruba cx 10000-48y6c \(s0f98a\); hpe: aruba cx 10040 \(s4r58a\); hpe: aruba cx 10040 32p \(s4r54a\); hpe: aruba cx 10040 32p \(s4r55a\); hpe: aruba cx 10040 32p \(s4r56a\); hpe: aruba cx 4100i 12-port \(jl817a\); hpe: aruba cx 4100i 24-port \(jl818a\); hpe: aruba cx 6000 12g \(r8n89a\); hpe: aruba cx 6000 12p \(r8n89b\); hpe: aruba cx 6000 12p \(s4r21a\); hpe: aruba cx 6000 24g \(r8n87a\); hpe: aruba cx 6000 24g \(r8n88a\)
References1
- support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us… Vendor Advisory
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 57 · as of 8 November 2026
- CWE
- CWE-284
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.