Executive brief
A vulnerability in configuration processing logic allows authenticated administrators to crash systems or execute code with root privileges by submitting malformed configuration data. This affects HPE network or infrastructure management components, potentially leading to service outages or full system compromise.
Technical details
The vulnerability is a stack-based buffer overflow in configuration processing logic that fails to properly validate malformed input. An authenticated remote attacker with administrative privileges can exploit this by crafting specially malformed configuration data. Successful exploitation results in remote code execution with root privileges or denial of service via system crash. The attack requires valid administrator credentials and network access to the affected component.
Affected products
- HPE <UNKNOWN> <UNKNOWN>
Timeline
- 2026-09-15: disclosed