Technical impact
The vulnerability is an unauthenticated web‑based open redirect that allows a remote attacker to cause users of the AOS‑CX Switch web interface to be redirected to an arbitrary URL. This type of weakness (CWE‑601) can be abused for phishing or malicious script delivery, compromising user confidence and potentially leading to credential compromise if users click on a fake login page. The security impact is primarily the loss of integrity and trust of the web interface, without immediate denial of service or data exfiltration.
Affected Systems
Affected systems are Hewlett Packard Enterprise AOS‑CX Switches. No specific product version information is provided in the CNA data, so owners should verify which firmware or software build is running.
Risk and Exploitability
The CVSS v3 score of 6.5 indicates moderate severity. The EPSS score is less than 1%, suggesting a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers only need unauthenticated access to the web interface, so the attack vector is remote over the network; however, the lack of higher severity or widespread exploitation data indicates that while the vulnerability is real, the likelihood of immediate impact is lower compared to higher‑score issues.
