A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.
PUBLISHED5.2
Error in SSID Processing allows Stored XSS in Web Management Interface
Affected products
Hewlett Packard Enterprise (HPE)
ArubaOS (AOS)
10.8.0.0 - AFFECTED
<= 10.7.2.2 - AFFECTED
<= 10.4.1.10 - AFFECTED
<= 8.13.1.1 - AFFECTED
<= 8.12.0.6 - AFFECTED
<= 8.10.0.21 - AFFECTED
References
GitHub Security Advisories
GHSA-7qhm-2x69-v62m
A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8...
https://github.com/advisories/GHSA-7qhm-2x69-v62mA vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-23819Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-23819",
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"dateUpdated": "2026-05-12T19:31:00.149Z",
"dateReserved": "2026-01-16T15:22:49.224Z",
"datePublished": "2026-05-12T18:31:33.726Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe",
"dateUpdated": "2026-05-12T18:31:33.726Z"
},
"title": "Error in SSID Processing allows Stored XSS in Web Management Interface",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.</p>"
}
]
}
],
"affected": [
{
"vendor": "Hewlett Packard Enterprise (HPE)",
"product": "ArubaOS (AOS)",
"defaultStatus": "affected",
"versions": [
{
"version": "10.8.0.0",
"status": "affected",
"versionType": "semver"
},
{
"version": "10.7.0.0",
"status": "affected",
"versionType": "semver",
"lessThanOrEqual": "10.7.2.2"
},
{
"version": "10.4.0.0",
"status": "affected",
"versionType": "semver",
"lessThanOrEqual": "10.4.1.10"
},
{
"version": "8.13.0.0",
"status": "affected",
"versionType": "semver",
"lessThanOrEqual": "8.13.1.1"
},
{
"version": "8.12.0.0",
"status": "affected",
"versionType": "semver",
"lessThanOrEqual": "8.12.0.6"
},
{
"version": "8.10.0.0",
"status": "affected",
"versionType": "semver",
"lessThanOrEqual": "8.10.0.21"
}
]
}
],
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"credits": [
{
"lang": "en",
"value": "Michael Messner",
"type": "reporter"
},
{
"lang": "en",
"value": "Benedikt Kuehne",
"type": "reporter"
},
{
"lang": "en",
"value": "Caio Adler Goncalves Farias",
"type": "reporter"
},
{
"lang": "en",
"value": "Siemens Energy",
"type": "sponsor"
}
]
},
"adp": [
{
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-05-12T19:31:00.149Z"
},
"title": "CISA ADP Vulnrichment",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79",
"type": "CWE"
}
]
}
],
"metrics": [
{}
]
}
]
}
}