Critical Vulnerabilities in HPE Networking AOS-Switch

The Netherlands National Cyber Security Centre (NCSC) has identified multiple critical vulnerabilities in HPE Networking AOS-Switch, a line of enterprise network devices used to manage and regulate data traffic. These vulnerabilities, which carry CVSS scores as high as 9.8, pose a significant risk to the integrity and availability of organizational networks.

The flaws allow unauthenticated attackers to bypass security controls, execute arbitrary code, exfiltrate sensitive information, or trigger denial-of-service (DoS) conditions. While there is no reported in-the-wild exploitation at this time, the severity of the potential impact necessitates prompt action from network administrators. Organizations are urged to prioritize the application of vendor-supplied patches and harden device configurations by isolating management interfaces from the public internet.

Impact

Successful exploitation could result in full device takeover, enabling attackers to intercept or modify internal network traffic, compromise credentials, or disrupt communication across the infrastructure. Given the critical role of these switches in corporate network backbones, the potential for lateral movement and broad network disruption is high. Organizations in all sectors using HPE AOS-Switch hardware are advised to audit their exposure and verify patch levels.

Recommendation

• Apply the latest security updates provided by HPE for all affected AOS-Switch deployments immediately.
• Disable direct internet access to switch management interfaces. Restrict management access to dedicated, secure out-of-band networks.
• Implement strict IP allowlisting to ensure that only authorized administrative workstations can access the device management ports.
• Coordinate with IT service providers to audit current firmware versions and confirm the application of vendor patches.