Hewlett Packard Enterprise (HPE) has released critical security updates to address multiple vulnerabilities found in Aruba Networking wireless software. These flaws could potentially allow attackers to gain complete control over compromised devices, making immediate patching a top priority for network administrators.
Details of the Vulnerabilities
The vulnerabilities impact AOS-8 and AOS-10 installations, which are used in Mobility Conductors, Controllers, Gateways, and access points. Some of these flaws allow for unauthorized access without needing valid login credentials, underscoring the urgency of deploying the patches promptly.
In HPE’s security bulletin, HPESBNW05162, issued on October 22, the company outlined several critical vulnerabilities including authentication bypass, command injection, SQL injection, and buffer overflow issues. Notably, eight of these vulnerabilities have been assigned the highest CVSS severity score of 10.0, indicating their potential to expose sensitive data and alter device configurations.
Potential Impact and Specific Flaws
One of the most severe vulnerabilities, identified as CVE-2026-79850, permits attackers to bypass AOS-8 authentication and execute root-level commands, thereby gaining full control over the system. Another flaw, CVE-2026-79855, impacts the AOS-8 SSH service, allowing unauthorized administrative access.
AOS-10 is also vulnerable, with CVE-2026-79845 affecting the PAPI protocol, potentially enabling attackers to bypass login checks and access confidential information. Additional vulnerabilities, such as CVE-2026-79847 and CVE-2026-79851, involve buffer overflows that could be exploited to execute code with elevated permissions.
Recommendations and Precautions
HPE advises updating to specific software versions, including AOS-10.8.1.2, AOS-10.7.2.7, and AOS-8.13.3.1, among others, to mitigate these risks. These updates are accessible through the HPE Networking Support Portal. Until patches are applied, it is recommended to limit access to command line and web management interfaces through dedicated network segments or VLANs, reinforced by firewall rules.
Implementing user activity monitoring and logging can further reduce vulnerability exposure, although these measures should not replace the installation of security patches. While HPE has not observed public exploit discussions, the absence of such reports does not guarantee that attacks have not occurred.
For systems running older, unsupported software, it is crucial to transition to maintained versions to ensure protection against emerging threats. HPE emphasizes the necessity of updating defenses promptly in response to new malware threats and integrating threat intelligence feeds from multiple sources.
