HPE ArubaOS AOS-8: Authenticated SSRF leading to remote code execution in CLI

Summary

A vulnerability in the command line interface of HPE ArubaOS AOS-8 allows an authenticated remote attacker with high privileges to perform a server-side request forgery (SSRF). Successful exploitation could allow execution of arbitrary commands on the underlying operating system. The attacker first needs administrator-level credentials, and the impact is primarily on integrity and availability.

Affected

• ArubaOS AOS-8.13.0.0 to 8.13.3.0
• ArubaOS AOS-8.10.0.0 to 8.10.0.23
• Per HPE bulletin, the 8.12 train has no fixed release and should be upgraded to a fixed train (confirm with HPE)
• Exact per-CVE version range and CVSS vector: to be verified in the CSAF file

Fixed in

• AOS-8.13.3.1 or later
• AOS-8.10.0.24 or later

Workaround

• No vendor workaround specific to this CVE is known.
• Restrict command line and web management interfaces to a dedicated management VLAN or Layer 2 segment, with firewall controls at Layer 3 and above.
• Limit administrator accounts to the people who need them.

Exploitation

• No exploitation in the wild reported at the time of research.
• Not listed in CISA KEV (recheck).
• No public proof-of-concept exploit known; HPE knew of no exploit code at release.
• CISA SSVC: Exploitation none, Automatable no, Technical impact total.

Our recommendation

• Patch Mobility Controllers, Mobility Gateways and Instant access points to the fixed builds listed above.
• Check whether the CLI and web management interfaces are reachable from user, guest or internet networks and restrict access.
• Review administrator accounts and enforce strong authentication.
• Monitor for unusual administrative activity and follow HPE advisory HPESBNW05162 for further updates.
• Note that other flaws in the same bulletin are unauthenticated; prioritise the update for the whole bulletin.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE Security Bulletin HPESBNW05162 support.hpe.com
• CCB Belgium advisory on multiple HPE Networking AOS vulnerabilities ccb.belgium.be
• Pulse: HPE Aruba AOS eight max-severity flaws pulse.adyog.com
• Cyberpress: critical HPE Aruba AOS-8 vulnerability cyberpress.org
• Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:37.