Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-73770: HPE AOS-CX lets logged‑in user write any file
CVE-2026-73770 · published 2 months ago
Summary
A weakness in HPE AOS-CX allows a user who has a valid login to write or change any file on the device and run commands with high‑level privileges. This could let an attacker take control of the system if another user triggers a required step. Apply the latest security update, restrict account privileges, and monitor for unusual file‑change activity.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| hewlett packard enterprise (hpe) | aos-cx | <= 10.18.0001 |
Original advisory text
An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, under specific conditions outside the attacker's control ...
An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, under specific conditions outside the attacker's control and following a required action by another user, to create or modify arbitrary files and execute arbitrary commands as a privileged user on the underlying operating system.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-73External Control of File Name or Path
Timeline
Published1 Sep 2026
Updated4 Nov 2026
First seen2 Sep 2026
Track software like this
Free during beta