A flaw in the maintenance restore feature of HPE Analytics and Location Engine allows an authenticated attacker to obtain unrestricted read, write, and execute permissions on the host file system with root privileges. This level of access can enable full system compromise, including installation of malicious software, persistence, and data exfiltration. The vulnerability arises from inadequate validation of user permissions before performing restore operations, resulting in a classic privilege escalation scenario.

HPE Analytics and Location Engine (ALE). No specific model or version details were provided, so all installations of this product are potentially affected until a patch is applied.

The CVSS score of 7.2 indicates a high severity risk. EPSS data is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is presumed to be a remote authenticated attacker who gains authorized access to the maintenance restore interface and then leverages the flaw to elevate privileges. Given the lack of publicly disclosed exploitation proof, the likelihood of an immediate widespread attack is uncertain, but the impact if exploited remains critical to system integrity and confidentiality.