An unauthenticated remote attacker can send crafted requests to internal endpoints in the Analytics and Location Engine (ALE) management interface, allowing the disclosure of sensitive data such as site hierarchy, infrastructure details, and client device information. The vulnerability enables unauthorized read access to privileged information, exposing corporate topology and potentially leading to data compromise.

The vulnerability affects Hewlett Packard Enterprise’s Analytics and Location Engine (ALE) product. No specific version ranges are listed in the advisory, so all released versions may be susceptible until a patch is applied.

The CVSS score of 7.5 indicates high severity, while the EPSS score is not available, so the current likelihood of exploitation is unknown. It is not listed in CISA KEV. Based on the description, it is inferred that the attacker can achieve this disclosure by contacting the ALE management interface over the network, meaning the attack vector is remote and unauthenticated.