Skip to content
CVE PROGRAM SOURCE RECORD8.3 High

CVE-2026-73780

Lack of Cross-Site Request Forgery (CSRF) Protections for Certificate-Authenticated Sessions in AOS-CX

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hpe

Description

A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery (CSRF) protection. This could allow a remote unauthenticated attacker to execute arbitrary input against the affected interface if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Hewlett Packard Enterprise (HPE) AOS-CX

Default version status: affected

  • 10.18.0000 to ≤ 10.18.0001affected
  • 10.17.0000 to ≤ 10.17.1021affected
  • 10.16.0000 to ≤ 10.16.1051affected
  • 10.13.0000 to ≤ 10.13.1180affected
  • 10.10.0000 to ≤ 10.10.1180affected

References