HPE ArubaOS AOS-8: Unauthenticated buffer overflow in web interface
Summary
Several web interface endpoints of HPE ArubaOS AOS-8 devices contain buffer overflows that can be triggered by unauthenticated remote attackers using specially crafted requests. Successful exploitation may allow arbitrary command execution on the underlying operating system and complete compromise of the device. The attack complexity is rated High, and the vulnerability is relevant mainly where the web management interface is reachable from untrusted networks.
Affected
- AOS-8.13.0.0 to 8.13.3.0
- AOS-8.10.0.0 to 8.10.0.23
- AOS-8.12.x: treated as affected until HPE confirms otherwise
- AOS-10: not affected by this CVE according to CVE-specific sources
Fixed in
- AOS-8.13.x: 8.13.3.1 or later
- AOS-8.10.x: 8.10.0.24 or later
- AOS-8.12.x: no fixed release; move to a fixed train (8.13.3.1 or later)
Note: Exact per-CVE fix table not yet verified against HPE advisory HPESBNW05162.
Workaround
- No CVE-specific workaround published.
- Restrict web and CLI management access to a dedicated management VLAN or firewall rules.
- Do not expose the web management interface to the internet.
- Log administrative activity.
Exploitation
- No known exploitation in the wild.
- Not listed in the CISA KEV catalogue (checked 24 October 2026).
- HPE knows of no public exploit code; no public PoC found in searches, which does not prove none exists.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Inventory all AOS-8 controllers, conductors and Instant APs and record exact builds (for example with show version).
- Restrict web and CLI management to a management VLAN or firewall rule now and confirm nothing is forwarded from the internet.
- Upgrade 8.13.x devices to 8.13.3.1 or later and 8.10.x devices to 8.10.0.24 or later; move 8.12 devices to a supported fixed train.
- Review management-interface logs since 22 October 2026 for unusual requests.
- Verify details against HPE advisory HPESBNW05162 and check NVD once analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- CVE record details (threatint) cve.threatint.com
- Brandefense vulnerability summary brandefense.io
- Carthage Electronics threat brief carthageelectronics.com
- Cybaverse AOS critical flaws www.cybaverse.co.uk
- Rescana AOS advisory summary www.rescana.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:04.
Original description (NVD)
Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.