CVE-2026-73782

Executive Summary

CVE-2026-73782 is an unauthenticated remote code execution vulnerability caused by a format string flaw in the command line interface of AOS-CX, the network operating system that powers HPE Aruba Networking CX-series switches. The vulnerability is exploitable from the adjacent network segment (AV:A) without requiring authentication, and successful exploitation grants an attacker the ability to execute arbitrary code as a privileged user on the underlying operating system. With a CVSS score of 8.8 and no patch or workaround currently available, this vulnerability represents a critical risk to any organization deploying AOS-CX devices in their network infrastructure.

Technical Analysis

CVE-2026-73782 is a format string vulnerability present in the command line interface (CLI) component of AOS-CX, HPE Aruba Networking's operating system for CX-series switching platforms. The NVD description identifies the flaw class as a format string vulnerability, which corresponds to CWE-134 (Use of Externally-Controlled Format String). In this vulnerability class, an application passes user-controlled or externally-influenced input directly as the format string argument to a formatting function such as printf-family routines.

The attack surface is the CLI of AOS-CX, which is typically exposed over network protocols such as Secure Shell (SSH) or the legacy Telnet protocol, as well as potentially through console access. The critical aspect of this vulnerability is that it requires no authentication — an unauthenticated attacker can reach the vulnerable code path during the pre-authentication phase of a CLI session. The vulnerability is exploitable over the adjacent network (AV:A in the CVSS vector), meaning an attacker must have access to the same Layer 2 segment or a directly adjacent network segment to reach the affected management interface. This adjacency requirement is consistent with how network device management planes are typically segmented.

The root cause lies in the CLI parser's handling of certain input strings. When an attacker supplies input containing format specifiers — such as %n, %x, %s, or %p — the vulnerable code path passes this input as the format string to a formatting function rather than treating it as a literal data argument. The %n specifier is particularly dangerous because it writes the number of bytes output so far to a memory address supplied on the stack, enabling arbitrary memory writes when carefully crafted in conjunction with stack manipulation.

The attack mechanism operates as follows:

1. The attacker establishes a connection to the AOS-CX management interface (SSH/Telnet)
2. During the authentication negotiation or initial CLI interaction phase, the attacker submits a specially crafted string containing format specifiers
3. The vulnerable formatting function interprets these specifiers, reading stack values and potentially writing arbitrary data to attacker-controlled memory addresses
4. This memory corruption can be leveraged to redirect code execution flow, ultimately achieving arbitrary code execution on the underlying operating system

The description states the impact as "the ability to execute arbitrary code as a privileged user on the underlying operating system." This indicates that successful exploitation bypasses the CLI permissions model and the separation between the CLI application and the host OS. The privilege level achieved is that of a privileged user, not merely a restricted CLI user.

The vulnerability is distinct from typical CLI authentication bypasses because it results in native code execution rather than merely gaining a CLI command shell. The arbitrary code executes as a privileged user on the underlying OS, which means an attacker can potentially disable security controls, extract configuration data including credentials, modify forwarding behavior, or leverage the compromised switch as a pivot point for lateral movement.

It is important to note that specific vulnerable functions, the exact input vector, and the precise protocol interaction (SSH vs. Telnet) are not disclosed in the NVD description. Insufficient technical detail is available to identify the exact code path or functions involved.

Exploitation Scenarios

Scenario 1: Compromise of Management Plane from Adjacent Network

1. Reconnaissance/Target Identification: An attacker performs network scanning to identify AOS-CX switches. This can be accomplished via banner grabbing on TCP port 22 (SSH) or scanning for AOS-CX-specific HTTP/TLS fingerprints. Since the CVSS vector specifies AV:A (adjacent network), the attacker must already have Layer 2 access to the segment where the switch management interface is reachable. This could be an attacker who has already breached a system on the same network segment or a rogue user with physical/virtual LAN access.

2. Triggering the Vulnerability: The attacker initiates an SSH (or potentially Telnet) connection to the switch's management interface. During the pre-authentication handshake, the attacker submits input crafted with format string specifiers as a username, password, or during the initial banner exchange. The vulnerable CLI parser processes this input through a formatting function without sanitization.

3. Payload Execution: At the vulnerability-class level, format string exploitation involves several stages. The attacker first uses %p or %x specifiers to leak stack memory and map the memory layout. Then, using %n specifiers with positional parameters (e.g., %1$n, %2$n), the attacker writes 2-byte or 4-byte values to addresses on the stack that control the return address of the current function or a function pointer. By chaining multiple writes, the attacker redirects execution to shellcode placed in the same payload or to a ROP (Return-Oriented Programming) chain. Since the vulnerability results in execution as a privileged user on the OS, the payload likely targets process-level escalation or directly executes OS commands.

4. Post-Exploitation Impact: With arbitrary code execution as a privileged user, the attacker can create local accounts, extract the running configuration (which contains network architecture details, VLAN configurations, and likely SNMP community strings), retrieve stored credentials, disable monitoring, manipulate ACLs and routing to redirect traffic for man-in-the-middle attacks, or use the switch as a stepping stone to reach other management-plane systems previously isolated.

Scenario 2: Worm-style Propagation within an Enterprise Segment

Since the vulnerability is unauthenticated and resides in a network device CLI, an attacker could automate exploitation and use the compromised switch as a launching point to target adjacent switches on the same management VLAN. The attacker would chain exploitation of multiple AOS-CX devices to maintain persistent footholds across network infrastructure. No public PoC is available at the time of this report; the attack chain is inferred from the format string vulnerability class and the context provided in the NVD description.

Impact Assessment

Business Impact:

• Confidentiality (High): AOS-CX switches store network configurations, credentials (including RADIUS/TACACS+ shared secrets), and potentially any traffic mirrored for monitoring. Full configuration access reveals network architecture, segmentation details, and security controls.
• Integrity (High): An attacker with code execution on the underlying OS can modify the switch's forwarding behavior, alter ACLs, disable security features, or install persistent backdoors that survive reboots.
• Availability (High): The attacker can disable the switch entirely, causing a network outage for all devices connected to that switch, or degrade performance through resource exhaustion.

Affected Systems: All AOS-CX devices with the vulnerable CLI implementation. The exact version range is not disclosed in available public data, making asset inventory challenging. Any HPE Aruba CX-series switch running AOS-CX is potentially affected.

Blast Radius: The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates:

• Attack Vector: Adjacent (attacker must be on the same network segment)
• Attack Complexity: Low (no special conditions required)
• Privileges Required: None (unauthenticated)
• User Interaction: None (no user action needed)
• Scope: Unchanged (the compromised switch is the affected scope)
• All Impact metrics High

The practical blast radius extends beyond the switch itself because network infrastructure compromise provides a vantage point to intercept, redirect, or disrupt all traffic flowing through the device. Given that CX-series switches are commonly deployed as access-layer or distribution-layer switches in enterprise campus networks, a compromise could affect thousands of connected endpoints.

Detection Guidance

Sigma Rule

title: AOS-CX CLI Format String Exploitation Attempt
id: c406be89-9aa8-402c-a87d-e0f67c5b2f8a
status: experimental
description: Detects attempts to exploit format string vulnerability CVE-2026-73782 in AOS-CX CLI via SSH/Telnet pre-authentication
author: valtersit.com Threat Intelligence
date: 2026/06/01
logsource:
  product: linux
  service: sshd
detection:
  selection_username:
    src_user|contains:
      - '%n'
      - '%x'
      - '%p'
      - '%s'
      - '%1$'
      - '%2$'
  selection_password:
    src_password|contains:
      - '%n'
      - '%x'
      - '%p'
      - '%.*n'
  condition: selection_username or selection_password
falsepositives:
  - Users attempting to use percentage symbols in credentials or usernames
  - Testing tools validating CLI input handling
level: high
---

### YARA Rule

```yara
rule AOSCX_FormatString_Exploit_Payloads {
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects format string payloads targeting CVE-2026-73782"
        cve = "CVE-2026-73782"
        date = "2026-06-01"
        reference = "NVD description: format string vulnerability in AOS-CX CLI"
        severity = "critical"

    strings:
        $fmt_n = /%[-+ #0]*\d*\.?\d*(ll|hh|h|l|L|q|j|z|t)?[n]/ ascii
        $fmt_write = /%[-+ #0]*\.?\d*\$[n]/ ascii
        $fmt_leak = /%[-+ #0]*\.?\d*\$[xsp]/ ascii
        $fmt_chain = /(%[^%]+){4,}/ ascii
        $ssh_probe = "SSH-2.0" ascii
        $telnet_probe = "User Access Verification" ascii

    condition:
        uint16(0) == 0x5A4D or filesize < 10MB and
        (($fmt_n or $fmt_write) and ($fmt_leak or $fmt_chain)) or
        ($fmt_write and $fmt_chain and #fmt_write > 3)
}

Suricata IDS Rule

alert tcp any any -> any 22 (msg:"CVE-2026-73782 AOS-CX CLI Format String Exploitation Attempt"; flow:to_server,established; content:"%n"; nocase; distance:0; content:"%x"; nocase; distance:0; content:"%p"; nocase; distance:0; classtype:attempted-admin; sid:202673782; rev:1; reference:cve,2026-73782;)

Elastic Detection

sequence by host.ip with maxspan=5s
  [ network where destination.port in (22, 23) and
    network.protocol in ("ssh", "telnet") and
    network.direction == "ingress" ]
  [ process where event.type == "start" and
    process.command_line like "*%n*" or
    process.command_line like "*%x*" or
    process.command_line like "*%p*" ]

Splunk SPL Query

index=network sourcetype=ssh:auth OR sourcetype=telnet
| where match(_raw, "(?i)%[0-9$.-]*[nspx]")
| stats count by src_ip, dest_ip, dest_port, _time
| where count > 3
| rename src_ip as "Source IP", dest_ip as "Target AOS-CX", dest_port as "Port"
| table _time, "Source IP", "Target AOS-CX", Port, count
| sort - count

Wazuh OSSEC Rule

<group name="aoscx_attacks,">
  <rule id="377958" level="15" frequency="3" timeframe="60">
    <if_sid>100001</if_sid>
    <regex pattern="%[0-9$.-]*[nspx]" >(?!.*%system32)</regex>
    <description>AOS-CX format string exploitation attempt (CVE-2026-73782)</description>
    <mitre>
      <id>T1190</id>
      <tactic>TA0001</tactic>
      <technique>Exploit Public-Facing Application</technique>
    </mitre>
    <group>authentication_failures,aoscx,cve_2026_73782</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

No patch evidence exists from any tracked source. The vendor has not released a fixed version of AOS-CX, and there are no vendor-supplied workarounds.

Immediate Mitigations:

1. Network Segmentation: Isolate management interfaces on a dedicated management VLAN or out-of-band management network. Restrict Layer 2 adjacency to the management plane. Since the attack vector is AV:A (adjacent), eliminating Layer 2 reachability from untrusted segments is the most effective immediate mitigation.
2. Access Control: Configure strict ACLs on the management interface limiting SSH/Telnet access to trusted management hosts only. HPE Aruba Networking recommends restricting CLI access via management ACLs.
3. Protocol Restriction: Disable Telnet if not actively required, as format string exploitation over a cleartext protocol simplifies payload delivery and packet manipulation. Require SSH for all CLI access.
4. Monitor Pre-Authentication Traffic: Deploy the detection rules above at all management-plane access points. Look for unusual format specifier patterns in authentication strings.

Patch/Upgrade Steps:

1. Monitor HPE Aruba Networking's security advisory portal and the vendor's AOS-CX release notes for a patched version.
2. When a patch is released, test it in a staging environment first, then roll out during a change window to all affected CX-series switches.
3. Subscribe to vendor security notifications to ensure rapid awareness of patch availability.

Long-Term Hardening:

1. Enable AAA and TACACS+/RADIUS: Centralize authentication to make it easier to revoke compromised credentials.
2. Disable Password-based SSH: Move to key-based authentication where possible to make pre-authentication exploitation more difficult.
3. Regular Vulnerability Scanning: Include network infrastructure devices in regular scanning and penetration testing programs. Network devices are often overlooked in favor of servers and endpoints.
4. Configuration Backups and Integrity Monitoring: Maintain a known-good baseline of device configuration to facilitate detection of unauthorized changes post-exploitation.
5. Monitor Vendor Advisories: HPE Aruba Networking regularly publishes security advisories; integrate this source into your vulnerability management intake.

References

1. NVD Entry for CVE-2026-73782 — NIST National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-73782
2. HPE Aruba Networking Security Advisories — HPE Aruba: https://www.arubanetworks.com/support-services/security-bulletins/
3. CWE-134: Use of Externally-Controlled Format String — MITRE: https://cwe.mitre.org/data/definitions/134.html
4. ATT&CK T1190: Exploit Public-Facing Application — MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/

Threat Actor Activity / Exploit-in-the-Wild: No evidence of exploitation in the wild has been reported. CISA KEV does not list this CVE. No public PoC, Nuclei template, or exploit code exists at the time of this report. The lack of public exploit artifacts does not reduce the risk, as the format string class is well-understood and exploitation techniques are mature and publicly documented. The unpatched status with a high CVSS score makes this vulnerability an attractive target for threat actors who can discover it via network scanning.