The vulnerability stems from the use of default, hard‑coded credentials for several administrative and system accounts within the HPE Analytics and Location Engine (ALE). An unauthenticated remote attacker can guess these known credentials, gaining entry to both the application’s management interface and the underlying operating system. This breach enables an attacker to read, modify, or delete data, install malware, or pivot to other systems, effectively compromising the entire platform.

Hewlett Packard Enterprise Analytics and Location Engine (ALE) devices and installations are impacted. Specific version information is not disclosed in the advisory.

The CVSS score of 9.8 indicates a critical risk, and the absence of an EPSS value suggests the exploit probability is not quantified but could be significant given the straightforward credential reuse attack. The vulnerability is not listed in the CISA KEV catalog, but its high severity implies it should be addressed promptly. An attacker can exploit it remotely without prior authentication, leveraging publicly known default passwords to gain full control of the system.