NotCVE - vendor:"Hewlett Packard Enterprise (HPE)" product:"AOS-CX" version:" <= 10.15.0005"

16 results (0.002 seconds)

CVSS: 6.0EPSS: 0%CPEs: 4EXPL: 0

CVE-2025-27080 – Authenticated Sensitive Information Disclosure exposes Credentials in AOS-CX Command Line Interface

https://notcve.org/view.php?id=CVE-2025-27080

18 Mar 2025 — Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Successful exploitation could allow an attacker to gain unauthorized access to services outside of the impacted switch, potentially leading to lateral movement involving those services. • https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04818en_us&docLocale=en_US • CWE-359: Exposure of Private Personal Information to an Unauthorized Actor •

CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0

CVE-2025-25042 – Authenticated Access Control Vulnerability allows Sensitive Information Disclosure in AOS-CX REST Interface

https://notcve.org/view.php?id=CVE-2025-25042

18 Mar 2025 — A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation could allow an attacker to read encrypted credentials of other users on the switch, potentially leading to further unauthorized access or data breaches. • https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04818en_us&docLocale=en_US • CWE-359: Exposure of Private Personal Information to an Unauthorized Actor •

CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0

CVE-2025-25040 – Failure to Properly Enforce Port ACLs on CPU generated packets in CX 9300 Switches

https://notcve.org/view.php?id=CVE-2025-25040

18 Mar 2025 — A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: - AOS-CX 10.14.xxxx : All patches - AOS-CX 10.15.xxxx : 10.15.1000 and below The vulnerability is specific to traffic originated by the CX 9300 switch platform and could allow an attacker to bypass ACL rules applied to routed ports on egress. As a result, port ACLs are not correctly enforced, which could lead to unauthorized traffic flow and violati... • https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04818en_us&docLocale=en_US • CWE-863: Incorrect Authorization •

CVSS: 3.4EPSS: 0%CPEs: 4EXPL: 0

CVE-2024-54010 – Unauthenticated Traffic Handling Flaw Allows Packet Leakage on HPE Aruba Networking CX 10000 series switches

https://notcve.org/view.php?id=CVE-2024-54010

08 Jan 2025 — A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to conduct a packet forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leadi... • https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04772.txt • CWE-863: Incorrect Authorization •

CVSS: 4.3EPSS: 0%CPEs: 60EXPL: 0

CVE-2022-23688

https://notcve.org/view.php?id=CVE-2022-23688

06 Sep 2022 — Multiple vulnerabilities exist in the processing of packet data by the LLDP service of AOS-CX. Successful exploitation of these vulnerabilities may allow an attacker to impact the availability of the AOS-CX LLDP service and/or the management plane of the switch in ArubaOS-CX Switches version(s): AOS-CX 10.09.xxxx: 10.09.1010 and below, AOS-CX 10.08.xxxx: 10.08.1050 and below, AOS-CX 10.06.xxxx: 10.06.0190 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address these security vulner... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt •

CVSS: 4.3EPSS: 0%CPEs: 60EXPL: 0

CVE-2022-23689

https://notcve.org/view.php?id=CVE-2022-23689

CVSS: 5.3EPSS: 0%CPEs: 60EXPL: 0

CVE-2022-23690

https://notcve.org/view.php?id=CVE-2022-23690

06 Sep 2022 — A vulnerability in the web-based management interface of AOS-CX could allow a remote unauthenticated attacker to fingerprint the exact version AOS-CX running on the switch. This allows an attacker to retrieve information which could be used to more precisely target the switch for further exploitation in ArubaOS-CX Switches version(s): AOS-CX 10.10.xxxx: 10.10.0002 and below, AOS-CX 10.09.xxxx: 10.09.1020 and below, AOS-CX 10.08.xxxx: 10.08.1060 and below, AOS-CX 10.06.xxxx: 10.06.0200 and below. Aruba has r... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt •

CVSS: 7.2EPSS: 0%CPEs: 20EXPL: 0

CVE-2022-23691

https://notcve.org/view.php?id=CVE-2022-23691

06 Sep 2022 — A vulnerability exists in certain AOS-CX switch models which could allow an attacker with access to the recovery console to bypass normal authentication. A successful exploit allows an attacker to bypass system authentication and achieve total switch compromise in ArubaOS-CX Switches version(s): AOS-CX 10.10.xxxx: 10.10.0002 and below, AOS-CX 10.09.xxxx: 10.09.1030 and below, AOS-CX 10.08.xxxx: 10.08.1070 and below, AOS-CX 10.06.xxxx: 10.06.0210 and below. Aruba has released upgrades for ArubaOS-CX Switch D... • https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt •

CVSS: 4.3EPSS: 0%CPEs: 60EXPL: 0

CVE-2022-23686

https://notcve.org/view.php?id=CVE-2022-23686

CVSS: 4.3EPSS: 0%CPEs: 60EXPL: 0

CVE-2022-23687

https://notcve.org/view.php?id=CVE-2022-23687

1 2