Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code execution with elevated privileges.

Multiple vulnerabilities have been identified in a daemon component of HPE's AOS-CX network operating system. The flaws stem from improper processing of malformed input, allowing unauthenticated remote attackers to exploit them by sending specially crafted packets. Successful exploitation can result in remote code execution with elevated privileges. No authentication is required, making this particularly dangerous for exposed network devices. The vulnerabilities affect HPE AOS-CX, which runs on Aruba/HPE switching hardware. An official advisory has been published by HPE via their support portal. Organizations running AOS-CX should apply patches or mitigations as soon as they become available. The severity is high due to the unauthenticated RCE potential with privilege escalation.