PT-2025-4796 · Hewlett Packard · Hpe Aruba Networking Fabric Composer

Published 2025-01-10 · Updated 2025-01-28 · CVE-2025-23054

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions HPE Aruba Networking Fabric Composer (affected versions not specified)

Description A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer is related to access control errors. This issue could allow an authenticated low-privilege operator user to perform operations not permitted by their privilege level. Successful exploitation could enable an attacker to manipulate user-generated files, potentially leading to unauthorized changes in critical system configurations. An attacker could also remotely elevate their privileges, access protected information, and modify system settings.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

CWE-264

Related Identifiers

BDU:2025-01329

CVE-2025-23054

Affected Products

Hpe Aruba Networking Fabric Composer

References · 8

• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_US · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23054 · Security Note
• https://osv.dev/vulnerability/CVE-2025-23054 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01329 · Security Note
• https://twitter.com/CVEnew/status/1884292717829562418 · Twitter Post
• https://t.me/cvedetector/16621 · Telegram Post
• https://vuldb.com/?id.293943 · Note
• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_US · Note