Authentication bypass in the web management interface of the Hewlett Packard Enterprise AOS‑S Switch allows an attacker without credentials to gain full administrative control. The flaw is a classic authentication bypass (CWE‑269) that enables a remote unauthenticated user to access management functions, configure the device, and exfiltrate data. This can compromise the entire network segment managed by the switch.

All Hewlett Packard Enterprise AOS‑S Switch devices are potentially affected, as the advisory does not specify firmware revisions. Any device running the web management interface of AOS‑S could be vulnerable.

The CVSS score of 9.8 marks this vulnerability as critical. The EPSS score of <1% indicates a presently low exploitation probability, yet the lack of a KEV listing does not lessen the urgency of addressing the flaw. Based on the description, an attacker can exploit this by sending crafted HTTP requests to the web interface from an external network; authentication is bypassed entirely, granting immediate administrative privileges. Because no additional privileges or user interaction are required, the flaw represents a significant security risk.