HPE AOS-8: Unauthenticated path traversal in PAPI protocol
Summary
A path traversal flaw in the PAPI management protocol of HPE AOS-8 wireless controllers and access points allows an unauthenticated attacker to read, modify and delete files on the underlying operating system. The attacker must be on the same or a logically adjacent network segment, for example via a compromised client, guest device or rogue device. HPE rates the flaw 9.6 (critical), and CISA SSVC rates the technical impact as total.
Affected
- AOS-8 8.13.0.0 to 8.13.3.0
- AOS-8 8.10.0.0 to 8.10.0.23
- AOS-8 8.12.x: unclear, to be confirmed against the HPE CSAF file
Fixed in
- AOS-8 8.13.3.1 (8.13 branch) or later
- AOS-8 8.10.0.24 (8.10 branch) or later
Workaround
- No CVE-specific workaround published in the sources reviewed. Verify in the HPE bulletin.
- Restrict UDP port 8211 to the access-point segment and block it from user and guest networks until patched.
Exploitation
- HPE reports no known exploitation and no public exploit code for the listed flaws.
- CISA SSVC: exploitation none, not automatable.
- Not listed in the CISA Known Exploited Vulnerabilities catalog according to secondary reporting (not verified directly).
Our recommendation
- Patch AOS-8 controllers, gateways and Instant APs to the fixed versions in the next maintenance window.
- Check whether PAPI (UDP 8211) or management interfaces are reachable from guest or user VLANs and restrict them.
- Review the device inventory, including virtual machines, and confirm the running build.
- Monitor logs for unusual file access or configuration changes on wireless controllers.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- CCB Belgium advisory on HPE Networking AOS ccb.belgium.be
- Rescana analysis of HPE Aruba AOS vulnerabilities www.rescana.com
- Safeguard.sh analysis of AOS-8 and AOS-10 vulnerabilities safeguard.sh
- SecurityOnline overview of HPE Networking AOS vulnerabilities securityonline.info
- Cybaverse critical HPE Aruba AOS flaws www.cybaverse.co.uk
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:17.
Original description (NVD)
An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vulnerability could allow an unauthenticated adjacent attacker to read, modify, and delete files on the underlying operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.