CVE-2026-23601

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23601", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2026-01-14T15:40:17.991Z", "datePublished": "2026-03-04T16:07:42.929Z", "dateUpdated": "2026-04-01T16:23:06.986Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2026-04-01T16:23:06.986Z"}, "title": "Frame Injection via Shared GTK Allows Traffic Spoofing and Client Compromise", "affected": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8)", "versions": [{"status": "affected", "version": "10.8.0.0", "versionType": "semver"}, {"status": "affected", "version": "10.7.0.0", "lessThanOrEqual": "10.7.2.2", "versionType": "semver"}, {"status": "affected", "version": "10.4.0.0", "lessThanOrEqual": "10.4.1.10", "versionType": "semver"}, {"status": "affected", "version": "8.13.0.0", "lessThanOrEqual": "8.13.1.1", "versionType": "semver"}, {"status": "affected", "version": "8.12.0.0", "lessThanOrEqual": "8.12.0.6", "versionType": "semver"}, {"status": "affected", "version": "8.10.0.0", "lessThanOrEqual": "8.10.0.21", "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions. A malicious actor can generate shared-key authenticated transmissions containing targeted payloads while impersonating the identity of a primary BSSID.Successful exploitation allows for the delivery of tampered data to specific endpoints, bypassing standard cryptographic separation.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions. A malicious actor can generate shared-key authenticated transmissions containing targeted payloads while impersonating the identity of a primary BSSID.Successful exploitation allows for the delivery of tampered data to specific endpoints, bypassing standard cryptographic separation.</p>"}]}], "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05026en_us&docLocale=en_US"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}}], "credits": [{"lang": "en", "value": "Xin'an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian, Zhaowei Tan,Srikanth V. Krishnamurthy from University of California, and Mathy Vanhoef from DistriNet, KU Leuven", "type": "finder"}], "source": {"advisory": "HPESBNW05026", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-327", "lang": "en", "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T17:52:14.142763Z", "id": "CVE-2026-23601", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T17:59:28.741Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23601", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T17:52:14.142763Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-327", "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T17:56:17.146Z"}}], "cna": {"title": "Frame Injection via Shared GTK Allows Traffic Spoofing and Client Compromise", "source": {"advisory": "HPESBNW05026", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Xin'an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian, Zhaowei Tan,Srikanth V. Krishnamurthy from University of California, and Mathy Vanhoef from DistriNet, KU Leuven"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8)", "versions": [{"status": "affected", "version": "10.8.0.0", "versionType": "semver"}, {"status": "affected", "version": "10.7.0.0", "versionType": "semver", "lessThanOrEqual": "10.7.2.2"}, {"status": "affected", "version": "10.4.0.0", "versionType": "semver", "lessThanOrEqual": "10.4.1.10"}, {"status": "affected", "version": "8.13.0.0", "versionType": "semver", "lessThanOrEqual": "10.13.1.1"}, {"status": "affected", "version": "8.12.0.0", "versionType": "semver", "lessThanOrEqual": "10.12.0.6"}, {"status": "affected", "version": "8.10.0.0", "versionType": "semver", "lessThanOrEqual": "10.13.0.21"}], "defaultStatus": "affected"}], "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05026en_us&docLocale=en_US"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions. A malicious actor can generate shared-key authenticated transmissions containing targeted payloads while impersonating the identity of a primary BSSID.Successful exploitation allows for the delivery of tampered data to specific endpoints, bypassing standard cryptographic separation.", "supportingMedia": [{"type": "text/html", "value": "<p>A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions. A malicious actor can generate shared-key authenticated transmissions containing targeted payloads while impersonating the identity of a primary BSSID.Successful exploitation allows for the delivery of tampered data to specific endpoints, bypassing standard cryptographic separation.</p>", "base64": false}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2026-03-04T16:07:42.929Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23601", "state": "PUBLISHED", "dateUpdated": "2026-03-04T17:59:28.741Z", "dateReserved": "2026-01-14T15:40:17.991Z", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "datePublished": "2026-03-04T16:07:42.929Z", "assignerShortName": "hpe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8)", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"status": "affected", "version": "10.8.0.0", "versionType": "semver"}, {"lessThanOrEqual": "10.7.2.2", "status": "affected", "version": "10.7.0.0", "versionType": "semver"}, {"lessThanOrEqual": "10.4.1.10", "status": "affected", "version": "10.4.0.0", "versionType": "semver"}, {"lessThanOrEqual": "8.13.1.1", "status": "affected", "version": "8.13.0.0", "versionType": "semver"}, {"lessThanOrEqual": "8.12.0.6", "status": "affected", "version": "8.12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "8.10.0.21", "status": "affected", "version": "8.10.0.0", "versionType": "semver"}]}], "source": "security-alert@hpe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "matchCriteriaId": "2B8A04E5-890D-4CBC-B504-2F50294C49A1", "versionEndIncluding": "8.10.0.21", "versionStartIncluding": "6.5.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "matchCriteriaId": "33943569-C024-4615-BA2C-874DD71EC077", "versionEndIncluding": "8.12.0.6", "versionStartIncluding": "8.11.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F95C3EA-87DF-448B-B63D-E469A38650AE", "versionEndIncluding": "8.13.1.1", "versionStartIncluding": "8.13.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "matchCriteriaId": "0ECE682E-B356-4960-AC0F-4C066B8CB7EE", "versionEndIncluding": "10.4.1.10", "versionStartIncluding": "10.3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E7CE262-1F72-4AE3-BE71-9E09EBF64B02", "versionEndIncluding": "10.7.2.2", "versionStartIncluding": "10.5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:10.8.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "291A71D4-415C-4478-9BC1-1873ED23B6E1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*", "matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*", "matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*", "matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*", "matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*", "matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*", "matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*", "matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*", "matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*", "matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*", "matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:9106:-:*:*:*:*:*:*:*", "matchCriteriaId": "086E2884-82B9-4909-973A-2AF9796EE6A3", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:9114:-:*:*:*:*:*:*:*", "matchCriteriaId": "D6758409-B957-486D-96C0-BCDD91BE4E8A", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:9240:-:*:*:*:*:*:*:*", "matchCriteriaId": "A6BF9E0D-630F-40B4-9109-560CA13C981B", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:ap-634:-:*:*:*:*:*:*:*", "matchCriteriaId": "69298E74-9FC7-4E96-9581-2B7F5CDD8956", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:ap-635:-:*:*:*:*:*:*:*", "matchCriteriaId": "B0219C4A-855C-4CCC-9C56-499697A91B94", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:ap-654:-:*:*:*:*:*:*:*", "matchCriteriaId": "7E4B96D6-2695-43E4-9956-872E0661B9ED", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:ap-655:-:*:*:*:*:*:*:*", "matchCriteriaId": "D18C831D-4D5C-4A50-8101-2CFB3D1B5210", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions. A malicious actor can generate shared-key authenticated transmissions containing targeted payloads while impersonating the identity of a primary BSSID.Successful exploitation allows for the delivery of tampered data to specific endpoints, bypassing standard cryptographic separation."}, {"lang": "es", "value": "Una vulnerabilidad ha sido identificada en el manejo del cifrado inal\u00e1mbrico de las transmisiones Wi-Fi. Un actor malicioso puede generar transmisiones autenticadas por clave compartida que contienen cargas \u00fatiles dirigidas mientras suplanta la identidad de un BSSID primario. La explotaci\u00f3n exitosa permite la entrega de datos manipulados a puntos finales espec\u00edficos, eludiendo la separaci\u00f3n criptogr\u00e1fica est\u00e1ndar."}], "id": "CVE-2026-23601", "lastModified": "2026-06-17T10:21:48.900", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-alert@hpe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23601", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T17:52:14.142763Z", "version": "2.0.3"}}]}, "published": "2026-03-04T17:16:18.610", "references": [{"source": "security-alert@hpe.com", "tags": ["Vendor Advisory"], "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05026en_us&docLocale=en_US"}], "sourceIdentifier": "security-alert@hpe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-327"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "10.8.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.7.0.0,10.7.2.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.4.0.0,10.4.1.10]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.13.0.0,10.13.1.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.12.0.0,10.12.0.6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.10.0.0,10.13.0.21]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8)", "source": "cna", "vendor": "Hewlett Packard Enterprise (HPE)"}, "product": "aruba_networking_wireless_operating_systems", "vendor": "hpe"}], "analysis": {"en": {"generated_at": "2026-04-16T05:44:29.267722+00:00", "value": {"mitigation_remediation": ["Apply any HPE Aruba firmware or software updates that address the shared\u2011GTK handling flaw.", "Enforce the use of strong pre\u2011shared keys and consider deactivating shared\u2011key authentication if it is not required, as a temporary workaround.", "Monitor wireless traffic for anomalous frames that claim the primary BSSID and alert on unexpected retransmissions."], "summary": {"action": "Apply Patch", "impact": "Bypass encryption and traffic spoofing"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts HPE Aruba Networking Wireless Operating System in both AOS-10 and AOS-8 platforms. Devices enumerated in the CPE list, including Aruba APs and controllers such as 7010, 7030, 7205, 7210, 7220, 7240xm, 7280, 9004\u2011lte, 9004, 9012, 9106, 9114, 9240, ap\u2011634, ap\u2011635, ap\u2011654, ap\u2011655, and the operating system itself (notably version 10.8.0.0). Specific supported firmware versions are not fully disclosed in this data.", "description_and_impact": "A flaw in Aruba Networking Wireless OS allows an attacker to craft shared-key authenticated frames that impersonate a primary BSSID. By sending these frames, the attacker can deliver targeted payloads to specific endpoints, bypassing normal cryptographic separation. This enables tampered data to reach victims and potentially compromises the client device, representing a significant data integrity and confidentiality threat based on CWE-327.", "risk_and_exploitability": "The reported CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% reflects a low probability of current exploitation. The vulnerability is not flagged in the CISA KEV catalog. Exploitation requires an attacker to have wireless transmission capability adjacent to the target network, suggesting that proximity or network access is required. Once the attacker can inject the crafted frames, the compromised traffic bypasses standard cryptographic checks, allowing tampered data to reach victim devices."}}}}, "created": "2026-03-05T09:08:35.650467+00:00", "updated": "2026-04-16T05:45:26.024418+00:00", "vendors": ["hpe", "hpe$PRODUCT$aruba_networking_wireless_operating_systems"]}