A vulnerability in the administrative component of Hewlett Packard Enterprise's Analytics and Location Engine (ALE) allows an attacker to perform a man‑in‑the‑middle attack without authentication. The flaw enables the injection and execution of arbitrary code with root privileges, giving full control over the appliance. The weakness is rooted in insufficient authentication and encryption of administrative traffic.

The affected product is Hewlett Packard Enterprise ALE appliances. No specific firmware or software version is mentioned, so all known releases containing the vulnerable administrative component may be impacted.

The CVSS score of 7.1 indicates high severity, but the EPSS score is not available and it is not listed in CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is an unauthenticated remote attacker intercepting unencrypted administrative traffic. The weakness in insecure transport (CWE‑300) facilitates exploitation. In environments where the ALE administrative interface is reachable from untrusted networks, the risk is significant; an exploit would lead to full compromise of the device.