HPE AOS-Switch: Buffer overflow leading to information disclosure and DoS
Summary
A buffer overflow in an interface of HPE AOS-Switch (AOS-S) firmware can be triggered by an unauthenticated remote attacker over the network. Successful exploitation can expose sensitive memory contents and cause a denial of service on the switch. The vendor describes the issue as unauthenticated and network-reachable, with low complexity.
Affected
- HPE AOS-Switch (AOS-S) 16.11.0000 to 16.11.0031 (per CVE record and OpenCVE; HPE states affected versions are 16.11.0031 and below)
- Whether earlier branches are affected: Unknown.
Fixed in
- Unknown. No fixed build has been confirmed by HPE for this CVE.
- A third-party source lists WC_16_11_0032.swi for the 2930F and 2930M, but this has not been confirmed as containing the fix.
Workaround
- Limit CLI and web management interfaces to a dedicated layer-2 segment or VLAN (HPE guidance for the bulletin as a whole).
- Apply firewall policies at layer 3 and above to restrict management access.
- Enable accounting controls for user activity.
Exploitation
- HPE is not aware of public discussion or exploit code as of the release date.
- No entry in the CISA KEV catalogue; EPSS below 1%.
- Current status: nothing known to indicate exploitation in the wild.
Our recommendation
- Inventory all AOS-S switches and verify firmware versions against 16.11.0031.
- Restrict management access to a management VLAN and block it from untrusted networks, guest networks and the internet.
- Monitor the HPE bulletin HPESBNW05156 for the confirmed fixed build and apply it promptly.
- Patch the whole bulletin, including CVE-2026-76744 (CVSS 9.8) and CVE-2026-76743 (authentication bypass).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05156 support.hpe.com
- OpenCVE: CVE-2026-76747 app.opencve.io
- CCB Belgium advisory on AOS-S vulnerabilities ccb.belgium.be
- CSAF advisory HPE hpesbnw05156 csaf.arubanetworking.hpe.com
- Canadian Centre for Cyber Security AV26-1046 www.cyber.gc.ca
- CVE-2026-76744 (CIRCL) cvepremium.circl.lu
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:22.
Original description (NVD)
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to expose sensitive memory contents and cause a denial of service on the device.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.