This vulnerability allows an authenticated low‑privilege operator to retrieve sensitive session information via the AOS‑CX API endpoint. The flaw stems from missing or improper authorization checks, enabling a privilege escalation path that bypasses normal access controls. Once the attacker obtains the data, they can increase their privileges and gain broader access to system resources.

Hewlett Packard Enterprise AOS‑CX. No specific vulnerable version was listed in the advisory; users should verify that their deployment is not on an affected release.

The CVSS score of 5.7 indicates moderate severity, and the EPSS score is currently unavailable. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated as a low‑privilege operator and to perform a defined user action. Because authentication is a prerequisite, the attack surface is limited to compromised or poorly secured accounts, but the lack of authorization checks creates a straightforward privilege escalation route once inside the system.