Executive brief
HPE's Analytics and Location Engine (ALE) contains a man-in-the-middle vulnerability in its administrative component that allows attackers to intercept unencrypted communications. An attacker on the network can exploit this to execute arbitrary code with root privileges on the appliance, gaining complete control of the system and all data it processes.
Technical details
The administrative component of ALE fails to properly secure communications, leaving it vulnerable to man-in-the-middle attacks. An unauthenticated remote attacker can intercept and modify administrative traffic to inject malicious code that executes with root privileges. The attack requires network access to the affected appliance but no prior authentication.
Affected products
- HPE Analytics and Location Engine
Timeline
- 2026-09-22: disclosed