Full Report
HPE security advisory (AV26-1046)
Analysis Summary
# Vulnerability: Multiple Flaws in HPE NonStop, iLO, and AOS-Switch Products
## CVE Details
*Note: The primary advisory (AV26-1046) references multiple underlying CVEs across three distinct product lines. Based on the consolidated Hewlett Packard Enterprise (HPE) reporting for this period:*
- **CVE ID:** CVE-2026-XXXXX (Multiple; see individual bulletins)
- **CVSS Score:** Up to 9.8 (Critical)
- **CWE:** Included but not limited to CWE-77 (Command Injection), CWE-79 (Cross-site Scripting), and CWE-119 (Memory Corruption).
## Affected Systems
- **Products:**
- HPE NonStop Servers / HTTP Webserver
- HPE Integrated Lights-Out (iLO) 5, 6, and 7
- HPE Networking AOS-Switch (AOS-S)
- **Versions:**
- **NonStop Webserver:** T1144L24^AAL and prior.
- **iLO 5:** Versions prior to 3.22.
- **iLO 6:** Versions prior to 1.79.
- **iLO 7:** Versions prior to 1.25.01.
- **AOS-Switch:** Version 16.11.0031 and prior.
- **Configurations:** Systems with remote management enabled (iLO) or running web-facing services (NonStop).
## Vulnerability Description
This advisory covers a suite of vulnerabilities affecting HPE infrastructure components. The primary flaws involve:
1. **Remote Code Execution (RCE):** Vulnerabilities in the iLO management firmware and AOS-Switch software that could allow an unauthenticated attacker to execute arbitrary code.
2. **Security Bypass:** Flaws in the HPE NonStop HTTP Webserver that may allow unauthorized access to sensitive server resources or configuration files.
3. **Denial of Service (DoS):** Issues within the AOS-Switch networking stack that could lead to system instability or crashes.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; however, internal PoCs exist for specific iLO vulnerabilities.
- **Complexity:** Low to Medium.
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Potential for full data exfiltration from management controllers).
- **Integrity:** High (Ability to modify firmware or switch configurations).
- **Availability:** High (Potential for total system shutdown or bricking of network hardware).
## Remediation
### Patches
HPE recommends upgrading to the following minimum firmware/software versions:
- **iLO 5:** Upgrade to v3.22.
- **iLO 6:** Upgrade to v1.79.
- **iLO 7:** Upgrade to v1.25.01.
- **AOS-Switch:** Upgrade to versions newer than 16.11.0031.
- **NonStop Webserver:** Consult HPE Support for the specific L-series SPR (Software Product Revision) applicable to your hardware.
### Workarounds
- **Network Segmentation:** Place iLO management ports on a dedicated, isolated management VLAN not accessible from the public internet or general production network.
- **Access Control Lists (ACLs):** Restrict access to AOS-Switch management interfaces to trusted IP addresses only.
- **Disable Unused Services:** Disable HTTP/HTTPS services on NonStop servers if not strictly required for operations.
## Detection
- **Indicators of Compromise:** Unusual administrative logins to iLO interfaces, unexpected reboot cycles of AOS switches, or unauthorized modification of web server configuration files.
- **Detection methods:** Use vulnerability scanners to identify outdated firmware versions. Monitor syslog for authentication failures or memory-related errors in networking hardware.
## References
- [Vendor Advisory: HPE NonStop Servers] hxxps[://]support[.]hpe[.]com/hpesc/public/docDisplay?docId=hpesbns05148en_us
- [Vendor Advisory: HPE iLO 5/6/7] hxxps[://]support[.]hpe[.]com/hpesc/public/docDisplay?docId=hpesbhf05170en_us
- [Vendor Advisory: HPE AOS-Switch] hxxps[://]support[.]hpe[.]com/hpesc/public/docDisplay?docId=hpesbnw05156en_us
- [HPE Security Bulletin Library] hxxps[://]support[.]hpe[.]com/connect/s/securitybulletinlibrary?language=en_US