This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] HPE Aruba Networking fixes 7 vulnerabilities
HPE Aruba fixes 6 vulnerabilities in Mobility Conductors, Mobility Controllers, Mobility Gateways and Access Points (AOS-10 and AOS-8) with versions 10.8.0.1, 10.7.2.3, 10.4.1.11, 8.13.1.2, 8.12.0.7 and 8.10.0.22 [1]. In addition, version 7.5.1 fixes 1 vulnerability in HPE Telco Network Function Virtualization Orchestrator [2]. The most severe vulnerabilities are described below; the remaining ones can be found at [1].
Allows an unauthenticated remote attacker, due to insufficient validation of the Host header in incoming HTTP requests in the Undertow component used in HPE Telco Network Function Virtualization Orchestrator, to have malicious requests processed, which may lead to cache poisoning, internal network scans or user session hijacking [2][3].
The vulnerability is present in product:
- HPE Telco Network Function Virtualization Orchestrator; >=7.5.0, <7.5.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
More information:
- CVE-2025-12543 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 31. 3. 2026.
Allows an unauthenticated attacker on an adjacent network, due to a flaw in the handling of wireless encryption via a controlled group temporal key (GTK) and spoofing of the wireless access point's basic service set identifier (BSSID), to inject frames, and thereby spoof network traffic and deliver modified data to selected clients [1].
The vulnerability is present in product:
- Aruba AOS; >=10.8.0.0, <10.8.0.1; >=10.7.2.2, <10.7.2.3; >=10.4.1.10, <10.4.1.11; >=8.13.1.1, <8.13.1.2; >=8.12.0.6, <8.12.0.7; >=8.10.0.21, <8.10.0.22
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
More information:
- CVE-2026-23601 at cve.org, NVD
- CWE-327: Use of a Broken or Risky Cryptographic Algorithm at cwe.mitre.org
The vulnerability was publicly disclosed 31. 3. 2026.
Allows an unauthenticated attacker on an adjacent network to spoof the client-controlled group temporal key (GTK) in the standardized wireless roaming protocol, and thereby inject frames, bypass client isolation, affect communication between clients and jeopardize network segmentation and the integrity and confidentiality of communication [1].
The vulnerability is present in product:
- Aruba AOS; >=10.8.0.0, <10.8.0.1; >=10.7.2.2, <10.7.2.3; >=10.4.1.10, <10.4.1.11; >=8.13.1.1, <8.13.1.2; >=8.12.0.6, <8.12.0.7; >=8.10.0.21, <8.10.0.22
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
More information:
- CVE-2026-23808 at cve.org, NVD
- CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 31. 3. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 1. 4. 2026.