The vulnerability is a web-based authentication bypass in HPE AOS-CX switches that allows an unauthenticated attacker to circumvent existing authentication controls and, in some circumstances, reset the admin password. This weakness is catalogued as CWE-287 and presents an opportunity for an attacker to gain administrative access, compromising the confidentiality, integrity, and availability of the device and the network it protects.

Affected systems are Hewlett Packard Enterprise HPE AOS-CX switches. The CVE entry does not provide specific model or firmware version information, so all product releases that include the affected web interface are potentially vulnerable.

The CVSS score of 9.8 classifies this issue as critical. EPSS is reported at less than 1 %, indicating that exploitation is currently unlikely, but the severity warrants immediate action. The vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited remotely by accessing the web interface over HTTP or HTTPS from an untrusted network, so the risk is high in environments where the interface is exposed externally.