CVE-2026-23813 — AOS-CX Pre-Auth Authentication Bypass

Unauthenticated remote attackers can reach the AOS-CX management REST API by smuggling a login token through nginx's over-permissive version regex, exposing the OVSDB-backed configuration surface (including the hashed admin credential).

• CVE: CVE-2026-23813
• CWE-287 · CVSS 9.8 (Critical)
• Vendor: HPE Aruba Networking · Product: AOS-CX
• Write-up: offseckit.com/blog/cve-2026-23813

Affected versions

Quick start

Check if a device is patched (defenders)

python3 detect.py <host[:port]>

Sends one read-only GET. Prints PATCHED, VULNERABLE, or UNKNOWN. Makes no changes. Suitable for inventory sweeps.

Understand the bypass (researchers)

python3 bypass_demo.py <host[:port]>

Sends the same endpoint twice — once normally, once with the smuggle — and prints the response codes side-by-side. No state change. See docs/root-cause.md for the why.

Demonstrate impact on 10.10.x (authorized testing only)

python3 exploit.py <host[:port]>

AOS-CX 10.10.x only. Creates a checkpoint via the unauthenticated path, reads the full running config, prints the admin hash. The cross-branch bypass works on every affected version, but this config-disclosure chain relies on backend behavior specific to the 10.10 branch. The checkpoint persists on the device — the REST endpoints reachable via the bypass do not accept DELETE; remove it via console / authorized session if needed.

Files

Requirements

Python 3.8+ and requests:

pip install requests

Credits

Independent post-patch analysis and PoC by 4252nez — write-up on OffSecKit. Original vulnerability reported by moonv via the HPE Bugcrowd program; this repository has no affiliation with that report.

License

MIT — see LICENSE.