Executive brief
AOS-CX is a networking operating system used to manage switches and network infrastructure. A privilege escalation flaw in its API allows authenticated low-privilege users to access sensitive information on the system after social engineering or tricking an authorized user into performing an action. This could lead to unauthorized disclosure of network configuration, credentials, or other confidential data.
Technical details
A privilege escalation vulnerability exists in the AOS-CX API endpoint that permits an authenticated low-privilege operator user to access sensitive data beyond their authorization level. The vulnerability requires user interaction (a required user action) as a precondition to exploitation. The attack vector is network-based, accessed through the API endpoint. Successful exploitation allows an attacker with valid low-privilege credentials to retrieve or view sensitive information normally restricted to higher-privileged roles. Fix availability should be confirmed via HPE security advisories.
Affected products
- HPE AOS-CX
Timeline
- 2026-09-01: disclosed