HPE Networking AOS-10: Buffer overflow in PAPI protocol leads to information disclosure
Summary
A buffer overflow in the PAPI protocol of HPE Networking AOS-10 allows an unauthenticated attacker on the same network segment to access sensitive information. The leaked data could help an attacker gain further access to network services supported by AOS-10, and the attack may also interrupt normal operation of the affected service. Exploitation requires adjacency to the network, and no exploitation is known.
Affected
- HPE ArubaOS (AOS-10) 10.8.0.0 to 10.8.1.1
- HPE ArubaOS (AOS-10) 10.7.0.0 to 10.7.2.6
- HPE ArubaOS (AOS-10) 10.4.0.0 to 10.4.1.13
- Status of 10.6.x branch: Unknown.
Fixed in
- AOS-10 10.8.1.2 or later (per secondary sources)
- AOS-10 10.7.2.7 or later
- AOS-10 10.4.1.14 or later
- Verify fixed versions in the HPE advisory HPESBNW05162 before deployment.
Workaround
- Unknown. HPE's specific workaround for this CVE could not be confirmed.
- Restrict access to AOS management interfaces as a general measure.
Exploitation
- No known exploitation.
- Not listed in CISA KEV.
- No public proof of concept found.
- CISA SSVC: Exploitation none, not automatable, partial technical impact.
Our recommendation
- Patch AOS-10 gateways and access points to the fixed versions, ideally together with the whole October 2026 HPE bulletin.
- Check the HPE advisory for the status of the 10.6.x branch and plan an upgrade if it is end-of-maintenance.
- Limit access to UDP port 8211 (PAPI) and management interfaces to trusted segments.
- Keep access points and gateways off guest and IoT networks.
- Verify the CVSS vector and CWE against the HPE advisory, as sources differ.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- CIRT.GY HPE Security Advisory summary cirt.gy
- SecurityOnline: HPE Networking AOS vulnerabilities securityonline.info
- Rescana: HPE Aruba AOS critical October 2026 www.rescana.com
- VulDB CVE entry 425542 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:21.
Original description (NVD)
A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, and to interrupt the normal operation of the affected service.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.