Source: Ministry of education information & communication security contingency platform
"" "" ""
| Publication Number | TACERT-ANA-2026031901031515 | Publication Time | 2026/03/19 13:57 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2026/03/19 13:57 |
| Impact Level | Low | ||
| [Subject] 【Vulnerability Alert】HPE Aruba Networking AOS-CX contains two critical security vulnerabilities |
|||
| [Content] Forwarded from TWCERTCC-200-202603-00000017 Recently, HPE released a critical security advisory for Aruba Networking AOS-CX (CVE-2026-23813, CVSS: 9.8 and CVE-2026-23814, CVSS: 8.8). CVE-2026-23813 exists in the web management interface of AOS-CX switches and may allow an unauthenticated remote attacker to bypass authentication mechanisms, potentially leading to administrator password reset under certain conditions. CVE-2026-23814 is a command injection vulnerability that may allow an authenticated remote attacker with low privileges to inject and execute malicious commands. (Information Sharing Level: WHITE (Information content can be publicly disclosed) |
|||
| [Affected Platform] AOS-CX versions up to and including 10.17.0001 AOS-CX versions up to and including 10.16.1020 AOS-CX versions up to and including 10.13.1160 AOS-CX versions up to and including 10.10.1170 |
|||
| [Recommended Actions]
Apply the remediation according to the solution provided on the official website: |
|||
| [Reference] |
|||