CVE-2026-23601mediumCWE-327

CVE-2026-23601: fallo de gravedad media en Hewlett Packard Enterprise (HPE) HPE Aruba…

Frame Injection via Shared GTK Allows Traffic Spoofing and Client Compromise

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear HPE Aruba Networking Wireless Operating System

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.4epss 0.1%
A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions. A malicious actor can generate shared-key authenticated transmissions containing targeted payloads while impersonating the identity of a primary BSSID.Successful exploitation allows for the delivery of tampered data to specific endpoints, bypassing standard cryptographic separation.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Productos afectados
Hewlett Packard Enterprise (HPE) · HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8)
CVEs relacionadas — Hewlett Packard Enterprise (HPE) HPE Aruba…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-23809MEDIUMMAC Address Spoofing leads to Inter-BSSID Isolation Bypass Resulting in Traffic RedirectionEPSS 0.3%CVE-2026-23808MEDIUMClient Isolation Bypass via GTK ManipulationEPSS 0.3%