Home / Technology / HPE Aruba Flaw Lets Hackers Reset Admin Passwords
HPE Aruba Flaw Lets Hackers Reset Admin Passwords
11 Mar
Summary
- A critical flaw allows unauthorized users to reset admin passwords.
- The vulnerability affects HPE's Aruba Networking AOS-CX OS.
- HPE released patches and advises immediate mitigation steps.
Hewlett Packard Enterprise (HPE) has announced critical security vulnerabilities affecting its Aruba Networking AOS-CX operating system. A severe authentication bypass flaw, identified as CVE-2026-23813, has a severity score of 9.1 out of 10 and enables unauthenticated attackers to reset administrator passwords.
The vulnerability specifically targets the web-based management interface of AOS-CX switches. HPE has also addressed four additional vulnerabilities, tracked as CVE-2026-23814 through CVE-2026-23817, impacting various versions of AOS-CX. While no exploitation has been reported currently, HPE strongly advises customers to apply the provided patches.
For immediate protection, HPE offers several mitigation strategies. These include restricting management interface access to isolated network segments, implementing strict Layer 3 access policies, disabling unnecessary HTTP(S) interfaces, enforcing Control Plane Access Control Lists, and enhancing logging for management activities.
