A flaw in the error handling of an HPE Aruba Networking Private 5G Core server API permits an unauthenticated remote attacker to retrieve sensitive data. The vulnerability can expose user accounts, roles, system configuration, internal services, and workflow details, thereby compromising confidentiality and potentially enabling later privilege escalation when combined with other weaknesses.

The affected product is HPE Aruba Networking Private 5G Core. No specific version information is provided in the advisory, so all current builds should be considered potentially vulnerable until a patch is applied.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % suggests that exploit attempts are unlikely but not impossible. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only unauthenticated API access, which could be achieved by sending crafted requests to the exposed API endpoints. The risk is primarily a confidentiality breach, but the exposed information could assist attackers in gaining higher privileges later.