A remote unauthenticated attacker can intercept traffic between a client and the AOS‑CX management API and retrieve information that was not intended to be exposed. This vulnerability allows the attacker to gain access to sensitive data that may help further compromise the system’s confidentiality. The weakness stems from insufficient encryption on the exposed API endpoint, allowing an attacker to intercept and read traffic via a man‑in‑the‑middle attack.

Hewlett Packard Enterprise AOS‑CX is affected. No specific version numbers are provided, so all installations of the product should be evaluated for this exposure.

The CVSS score of 5.9 indicates medium severity. The EPSS score is 0.00212, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, meaning it has no known active exploit at this time. The most likely attack vector is a remote attacker positioned between the client and the affected system who can intercept and read traffic. Exploitation requires no authentication, but the attacker must be able to observe communication to the vulnerable API endpoint.