HPE Aruba Networking AOS-CX Authentication Bypass Vulnerability Allowing Unauthenticated Password Reset

An authentication bypass vulnerability has been identified in the web-based management interface of HPE Aruba Networking AOS-CX switches. This vulnerability could allow an unauthenticated remote actor to circumvent authentication controls, potentially enabling the actor to reset the admin password. The issue affects AOS-CX versions 10.17.0001 and below, 10.16.1020 and below, 10.13.1160 and below, and 10.10.1170 and below.

Impact

Exploitation of this vulnerability could lead to unauthorized password resets, allowing for potential unauthorized access or actions within the affected system.

Remediation

Users are advised to upgrade to AOS-CX versions 10.17.1001 and above, 10.16.1030 and above, 10.13.1161 and above, or 10.10.1180 and above, depending on their current version. These updated versions can be downloaded from the HPE Networking Support Portal.