Executive brief
A security vulnerability has been identified in the management interface of HPE Aruba AOS-10 Gateways, which are devices used to manage and secure enterprise network traffic. An authorized administrator could exploit this flaw to access sensitive system files that should normally be protected. This could lead to the exposure of confidential configuration data or system information, which might be used to facilitate more advanced attacks against the network infrastructure.
Technical details
An improper access control vulnerability (CWE-284) exists in the web-based management interface of HPE Aruba AOS-10 Gateways. The flaw allows a remote attacker with high-privileged authentication (PR:H) to bypass intended file access restrictions and read sensitive files on the underlying operating system. The attack is low complexity and requires no user interaction. Successful exploitation results in a high impact on confidentiality as system-level information can be disclosed, though it does not directly provide integrity or availability impacts. Users should refer to HPE advisory hpesbnw05048en_us for specific patched firmware versions.
Affected products
- HPE Aruba Networking AOS-10 Gateway
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory