{"id":"CVE-2026-79878","kind":"vulnerability","aliases":["CVE-2026-79878"],"related":[],"title":"Alcatel-Lucent AOS-8: unauthenticated PAPI packets run code as root","description":"A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","summary":"Command injection in the AOS-8 CLI reached over PAPI (UDP 8211) lets an unauthenticated attacker on an adjacent network run shell commands on the controller. CVSS 8.8 (AV:A). HPE reports no exploitation and no public PoC.","severity":"high","cvss":8.8,"epss":0.00801,"exploited":false,"exploited_at":null,"products":[{"name":"HPE AOS-8","fixed":["8.13.3.1","8.10.0.24"],"affected":">= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-8","aruba","hpe","infrastructure","network-appliance","papi","rce","self-hosted","wireless-controller"],"not_affected_if":["non-aos-8-hardware","udp-8211-filtered","unknown"],"how_to_check":"Run 'show version' on each AOS-8 Mobility Conductor/Controller/Gateway. Affected: 8.12.0.0 to 8.13.3.0 and 8.10.0.0 to 8.10.0.23. Check whether UDP 8211 (PAPI) and the CLI are reachable from untrusted segments.","fix":"Upgrade AOS-8 to 8.13.3.1 or 8.10.0.24 or later (fixed versions inferred from the same HPE bulletin; confirm in HPESBNW05162). Until then, restrict CLI/web management and PAPI to a dedicated L2 segment/VLAN or L3+ firewall policy.","status":"open","published_at":"2026-10-22T19:18:00+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:44+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.65,"triage":{"at":"2026-10-23T22:31:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Alcatel-Lucent AOS-8: unauthenticated PAPI packets run code as root","impact":"high","summary":"A command injection flaw in the AOS-8 command line interface, reached over the PAPI protocol on UDP port 8211, lets an unauthenticated attacker send crafted packets. Successful exploitation runs arbitrary code as a privileged user on the underlying operating system.","category":"infrastructure","who_cares":["aos-8","network-appliance","papi"],"confidence":0.7,"needs_auth":"no","worst_case":"unauthenticated attacker runs arbitrary code as privileged OS user","analyst_note":"Find the vendor advisory and affected/fixed AOS-8 versions and any PAPI port exposure guidance; the NVD entry alone gives no version or fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["udp-8211-filtered","non-aos-8-hardware"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000486,"input_tokens":2953,"output_tokens":382,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and affected/fixed AOS-8 versions and any PAPI port exposure guidance; the NVD entry alone gives no version or fix.","search":"'-2026':14A,17A '-79878':15A,18A '-8':5A,21A,23B,43B,83C '8.8':65B '8211':49B,114C 'access':87C 'adjac':56B,101C 'alcatel':2A 'alcatel-luc':1A 'allow':118C 'ao':4A,22B,42B,82C 'aos':20A 'applianc':29B 'arbitrari':123C 'aruba':24B 'attack':53B,102C,120C 'av':66B 'cli':44B 'code':10A,97C,124C 'command':38B,60B,77C,84C 'control':37B,63B 'could':92C,117C 'craft':105C 'cve':13A,16A 'cvss':64B 'destin':108C 'execut':98C,122C 'exploit':71B,116C 'host':34B 'hpe':19A,25B,68B 'infrastructur':26B 'inject':39B,78C 'interfac':86C 'lead':93C 'let':50B 'line':85C 'lucent':3A 'network':28B,57B 'network-appli':27B 'oper':132C 'packet':8A,107C 'papi':7A,30B,47B,90C,106C,111C 'poc':75B 'port':113C 'privileg':127C 'protocol':91C 'public':74B 'rce':31B 'reach':45B 'remot':96C 'report':69B 'root':12A 'run':9A,58B 'self':33B 'self-host':32B 'send':103C 'shell':59B 'special':104C 'success':115C 'system':133C 'udp':48B,112C 'unauthent':6A,52B,95C 'under':131C 'user':128C 'vulner':79C 'wireless':36B 'wireless-control':35B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79878","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79878","severity":null,"published_at":"2026-10-22T19:18:00+00:00","modified_at":"2026-10-23T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79878:490","url":null,"severity":null,"published_at":"2026-10-23T23:39:45+00:00","modified_at":"2026-10-23T23:39:45+00:00","first_seen_at":"2026-10-23T23:39:45+00:00","fetched_at":"2026-10-23T23:39:45+00:00","note":"Part of HPESBNW05162 (2026-10-22). HPE page is JS-only; affected range from CNA data via controlassurance (8.12.0.0-8.13.3.0, 8.10.0.0-8.10.0.23); fixed 8.13.3.1/8.10.0.24 inferred from sibling CVEs in the same bulletin, not read per-CVE. CVSS 8.8 is adjacent (AV:A), not remote like siblings. No exploitation or PoC reported by HPE."},{"source":"epss","external_id":"CVE-2026-79878","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79878","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2095,"url":"https://intel.controlassurance.com/cves/2026/79xxx/CVE-2026-79878.html","title":"CVE-2026-79878 - Threat Intelligence Index","kind":"other","source":"analyst","text":"CNA data: CVSS 3.1 8.8 AV:A/AC:L/PR:N/UI:N. Affected AOS-8 8.12.0.0 through 8.13.3.0 and 8.10.0.0 through 8.10.0.23. Reference HPESBNW05162.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}