An exposed error‑handling path in the HPE Aruba Networking 5G Core API permits an unauthenticated remote attacker to retrieve sensitive system data. The flaw can reveal user accounts, roles, system configuration, and internal service details, potentially assisting attackers in planning privilege escalation or further exploitation. The vulnerability is a classic information disclosure weakness, classified as CWE‑209.

Hewlett Packard Enterprise’s Aruba Networking Private 5G Core platform is affected. The specific API endpoints and versions are not enumerated in the advisory, but any instance of the 5G Core server REST API that lacks proper authentication controls for error responses is susceptible.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation as of the latest measurement. The vulnerability remains outside the CISA KEV catalog. The likely attack vector is remote over the network: an unauthenticated attacker can send crafted API requests to trigger error responses that leak data. No additional prerequisites such as privileged access or exploitation of other vulnerabilities are required to extract the disclosed information, though it could be combined with other weaknesses for a more damaging attack.