This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] HPE Aruba Networking fixes 9 vulnerabilities
HPE Aruba fixes 9 vulnerabilities in HPE Aruba Networking Private 5G Core and EdgeConnect SD-WAN Orchestrator. The most severe vulnerabilities are described below; the remaining ones can be found at [1][2]. Products and their fixed versions: HPE Aruba Networking Private 5G Core - 1.25.1.0 [1] HPE Aruba Networking EdgeConnect SD-WAN Orchestrator - 9.6.1, 9.5.6, 9.4.8 [2]
Allows an unauthenticated attacker on the local network to create an unauthorized administrator account due to an authentication bypass in the application API, thereby gaining administrator access, changing the system configuration, and accessing or manipulating sensitive data [1].
The vulnerability is present in product:
- HPE Aruba Networking Private 5G Core; >=1.24.3.0, <=1.24.3.3
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-23595 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 10. 2. 2026.
Allows an authenticated remote attacker to execute arbitrary SQL commands and manipulate data due to vulnerabilities in the EdgeConnect SD-WAN Orchestrator web management interface [2].
The vulnerability is present in product:
- EdgeConnect SD-WAN Orchestrator; >=9.6.0, <9.6.1; >=9.5.0, <9.5.6; >=9.4.0, <9.4.8
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-37181 at cve.org, NVD
- CVE-2025-37182 at cve.org, NVD
- CVE-2025-37183 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 10. 2. 2026.
Allows an unauthenticated attacker on the local network to obtain sensitive information about accounts, roles and configuration due to insufficient error handling in the HPE Aruba Networking 5G Core API, which, combined with other vulnerabilities, may facilitate unauthorized access and privilege escalation [1].
The vulnerability is present in product:
- HPE Aruba Networking Private 5G Core; >=1.24.3.0, <=1.24.3.3
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2026-23597 at cve.org, NVD
- CVE-2026-23598 at cve.org, NVD
- CWE-209: Generation of Error Message Containing Sensitive Information at cwe.mitre.org
The vulnerability was publicly disclosed 12. 2. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 17. 2. 2026.