A device connecting to an Aruba access point can present itself as the network gateway by spoofing an address. The flaw allows the attacker to redirect traffic flows, effectively positioning itself as a Man-in-the-Middle and potentially intercepting or modifying data intended for the legitimate gateway. This can compromise confidentiality and integrity of network traffic.

Hewlett Packard Enterprise’s Aruba Networking Wireless Operating Systems AOS‑8 and AOS‑10 are affected. Specific firmware versions are not listed in the advisory, but all devices running these operating systems are at risk unless a recent firmware update addressing the spoofing fix is installed.

CVSS score 4.3 indicates a moderate severity. EPSS is below 1%, suggesting low current exploitation likelihood, and the vulnerability is not cataloged in CISA’s KEV list. The attack most likely requires an attacker to join the local network as a standard wired or wireless client, then use address-based spoofing to masquerade as the gateway. If successful, the attacker gains control over the data path between clients and the network, enabling interception or alteration of traffic. Defenders should apply the vendor-supplied firmware update and monitor for suspicious gateway behavior.