CVE-2026-23812

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23812", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2026-01-16T15:22:38.202Z", "datePublished": "2026-03-04T16:13:48.086Z", "dateUpdated": "2026-04-01T16:21:09.805Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2026-04-01T16:21:09.805Z"}, "title": "Security Boundary Bypass via Routing Node Impersonation", "affected": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "HPE Aruba Networking Wireless Operating Systems (AOS-8 & AOS-10)", "versions": [{"status": "affected", "version": "10.8.0.0", "versionType": "semver"}, {"status": "affected", "version": "10.7.0.0", "lessThanOrEqual": "10.7.2.2", "versionType": "semver"}, {"status": "affected", "version": "10.4.0.0", "lessThanOrEqual": "10.4.1.10", "versionType": "semver"}, {"status": "affected", "version": "8.13.0.0", "lessThanOrEqual": "8.13.1.1", "versionType": "semver"}, {"status": "affected", "version": "8.12.0.0", "lessThanOrEqual": "8.12.0.6", "versionType": "semver"}, {"status": "affected", "version": "8.10.0.0", "lessThanOrEqual": "8.10.0.21", "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique. Successful exploitation enables the redirection of data streams, allowing for the interception or modification of traffic intended for the legitimate network gateway via a Machine-in-the-Middle (MitM) position.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique. Successful exploitation enables the redirection of data streams, allowing for the interception or modification of traffic intended for the legitimate network gateway via a Machine-in-the-Middle (MitM) position.</p>"}]}], "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05026en_us&docLocale=en_US"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Xin'an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian, Zhaowei Tan,Srikanth V. Krishnamurthy from University of California, and Mathy Vanhoef from DistriNet, KU Leuven", "type": "finder"}], "source": {"advisory": "HPESBNW05026", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-300", "lang": "en", "description": "CWE-300 Channel Accessible by Non-Endpoint"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T17:47:35.522639Z", "id": "CVE-2026-23812", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T17:47:54.403Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23812", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T17:47:35.522639Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-300", "description": "CWE-300 Channel Accessible by Non-Endpoint"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T17:47:46.335Z"}}], "cna": {"title": "Security Boundary Bypass via Routing Node Impersonation", "source": {"advisory": "HPESBNW05026", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Xin'an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian, Zhaowei Tan,Srikanth V. Krishnamurthy from University of California, and Mathy Vanhoef from DistriNet, KU Leuven"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "HPE Aruba Networking Wireless Operating Systems (AOS-8 & AOS-10)", "versions": [{"status": "affected", "version": "10.8.0.0", "versionType": "semver"}, {"status": "affected", "version": "10.7.0.0", "versionType": "semver", "lessThanOrEqual": "10.7.2.2"}, {"status": "affected", "version": "10.4.0.0", "versionType": "semver", "lessThanOrEqual": "10.4.1.10"}, {"status": "affected", "version": "8.13.0.0", "versionType": "semver", "lessThanOrEqual": "10.13.1.1"}, {"status": "affected", "version": "8.12.0.0", "versionType": "semver", "lessThanOrEqual": "10.12.0.6"}, {"status": "affected", "version": "8.10.0.0", "versionType": "semver", "lessThanOrEqual": "10.13.0.21"}], "defaultStatus": "affected"}], "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05026en_us&docLocale=en_US"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique. Successful exploitation enables the redirection of data streams, allowing for the interception or modification of traffic intended for the legitimate network gateway via a Machine-in-the-Middle (MitM) position.", "supportingMedia": [{"type": "text/html", "value": "<p>A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique. Successful exploitation enables the redirection of data streams, allowing for the interception or modification of traffic intended for the legitimate network gateway via a Machine-in-the-Middle (MitM) position.</p>", "base64": false}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2026-03-04T16:13:48.086Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23812", "state": "PUBLISHED", "dateUpdated": "2026-03-04T17:47:54.403Z", "dateReserved": "2026-01-16T15:22:38.202Z", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "datePublished": "2026-03-04T16:13:48.086Z", "assignerShortName": "hpe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "HPE Aruba Networking Wireless Operating Systems (AOS-8 & AOS-10)", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"status": "affected", "version": "10.8.0.0", "versionType": "semver"}, {"lessThanOrEqual": "10.7.2.2", "status": "affected", "version": "10.7.0.0", "versionType": "semver"}, {"lessThanOrEqual": "10.4.1.10", "status": "affected", "version": "10.4.0.0", "versionType": "semver"}, {"lessThanOrEqual": "8.13.1.1", "status": "affected", "version": "8.13.0.0", "versionType": "semver"}, {"lessThanOrEqual": "8.12.0.6", "status": "affected", "version": "8.12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "8.10.0.21", "status": "affected", "version": "8.10.0.0", "versionType": "semver"}]}], "source": "security-alert@hpe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "matchCriteriaId": "2B8A04E5-890D-4CBC-B504-2F50294C49A1", "versionEndIncluding": "8.10.0.21", "versionStartIncluding": "6.5.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "matchCriteriaId": "33943569-C024-4615-BA2C-874DD71EC077", "versionEndIncluding": "8.12.0.6", "versionStartIncluding": "8.11.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F95C3EA-87DF-448B-B63D-E469A38650AE", "versionEndIncluding": "8.13.1.1", "versionStartIncluding": "8.13.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "matchCriteriaId": "0ECE682E-B356-4960-AC0F-4C066B8CB7EE", "versionEndIncluding": "10.4.1.10", "versionStartIncluding": "10.3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E7CE262-1F72-4AE3-BE71-9E09EBF64B02", "versionEndIncluding": "10.7.2.2", "versionStartIncluding": "10.5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:10.8.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "291A71D4-415C-4478-9BC1-1873ED23B6E1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*", "matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*", "matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*", "matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*", "matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*", "matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*", "matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*", "matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*", "matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*", "matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*", "matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:9106:-:*:*:*:*:*:*:*", "matchCriteriaId": "086E2884-82B9-4909-973A-2AF9796EE6A3", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:9114:-:*:*:*:*:*:*:*", "matchCriteriaId": "D6758409-B957-486D-96C0-BCDD91BE4E8A", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:9240:-:*:*:*:*:*:*:*", "matchCriteriaId": "A6BF9E0D-630F-40B4-9109-560CA13C981B", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:ap-634:-:*:*:*:*:*:*:*", "matchCriteriaId": "69298E74-9FC7-4E96-9581-2B7F5CDD8956", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:ap-635:-:*:*:*:*:*:*:*", "matchCriteriaId": "B0219C4A-855C-4CCC-9C56-499697A91B94", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:ap-654:-:*:*:*:*:*:*:*", "matchCriteriaId": "7E4B96D6-2695-43E4-9956-872E0661B9ED", "vulnerable": false}, {"criteria": "cpe:2.3:h:arubanetworks:ap-655:-:*:*:*:*:*:*:*", "matchCriteriaId": "D18C831D-4D5C-4A50-8101-2CFB3D1B5210", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique. Successful exploitation enables the redirection of data streams, allowing for the interception or modification of traffic intended for the legitimate network gateway via a Machine-in-the-Middle (MitM) position."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad donde un atacante que se conecta a un punto de acceso como un cliente cableado o inal\u00e1mbrico est\u00e1ndar puede suplantar una puerta de enlace aprovechando una t\u00e9cnica de suplantaci\u00f3n basada en direcciones. La explotaci\u00f3n exitosa permite la redirecci\u00f3n de flujos de datos, permitiendo la interceptaci\u00f3n o modificaci\u00f3n del tr\u00e1fico destinado a la puerta de enlace de red leg\u00edtima a trav\u00e9s de una posici\u00f3n de Hombre en el Medio (MitM)."}], "id": "CVE-2026-23812", "lastModified": "2026-06-17T10:22:08.483", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-alert@hpe.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23812", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T17:47:35.522639Z", "version": "2.0.3"}}]}, "published": "2026-03-04T17:16:19.357", "references": [{"source": "security-alert@hpe.com", "tags": ["Vendor Advisory"], "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05026en_us&docLocale=en_US"}], "sourceIdentifier": "security-alert@hpe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-300"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "10.8.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.7.0.0,10.7.2.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.4.0.0,10.4.1.10]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.13.0.0,10.13.1.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.12.0.0,10.12.0.6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.10.0.0,10.13.0.21]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "HPE Aruba Networking Wireless Operating Systems (AOS-8 & AOS-10)", "source": "cna", "vendor": "Hewlett Packard Enterprise (HPE)"}, "product": "aruba_networking_wireless_operating_systems", "vendor": "hpe"}], "analysis": {"en": {"generated_at": "2026-04-15T23:47:42.119720+00:00", "value": {"mitigation_remediation": ["Apply the latest Aruba OS firmware update that addresses the address\u2011spoofing issue", "Disable or restrict address\u2011based spoofing features on access points if configuration allows", "Monitor network traffic for anomalous gateway behavior or unauthorized redirection of data streams"], "summary": {"action": "Apply Patch", "impact": "Man-in-the-Middle (MitM)"}, "threat_synthesis": {"affected_systems": "Hewlett Packard Enterprise\u2019s Aruba Networking Wireless Operating Systems AOS\u20118 and AOS\u201110 are affected. Specific firmware versions are not listed in the advisory, but all devices running these operating systems are at risk unless a recent firmware update addressing the spoofing fix is installed.", "description_and_impact": "A device connecting to an Aruba access point can present itself as the network gateway by spoofing an address. The flaw allows the attacker to redirect traffic flows, effectively positioning itself as a Man-in-the-Middle and potentially intercepting or modifying data intended for the legitimate gateway. This can compromise confidentiality and integrity of network traffic.", "risk_and_exploitability": "CVSS score 4.3 indicates a moderate severity. EPSS is below 1%, suggesting low current exploitation likelihood, and the vulnerability is not cataloged in CISA\u2019s KEV list. The attack most likely requires an attacker to join the local network as a standard wired or wireless client, then use address-based spoofing to masquerade as the gateway. If successful, the attacker gains control over the data path between clients and the network, enabling interception or alteration of traffic. Defenders should apply the vendor-supplied firmware update and monitor for suspicious gateway behavior."}}}}, "created": "2026-03-05T09:08:30.896174+00:00", "updated": "2026-04-16T00:00:14.127519+00:00", "vendors": ["hpe", "hpe$PRODUCT$aruba_networking_wireless_operating_systems"]}