Wireless Network Traffic Redirection Vulnerability in HPE Products
CVE-2026-23809

5.4MEDIUM

Key Information:

Vendor

HP (HP)

Status
HP Aruba Networking Wireless Operating System (aos-10 & Aos-8)
Vendor
CVE Published:
4 March 2026

What is CVE-2026-23809?

A vulnerability exists in HPE Wireless Solutions due to the misuse of a port-stealing method that has been adapted for Wi-Fi networks utilizing multiple BSSIDs. This flaw allows attackers to exploit the relationship between BSSIDs and their corresponding virtual ports, potentially bypassing inter-BSSID isolation safeguards. The exploitation of this vulnerability could permit an attacker to intercept and redirect network traffic, leading to risks such as eavesdropping, session hijacking, or denial of service, compromising security and privacy in network communications.

Affected Version(s)

HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8) 10.8.0.0

HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8) 10.8.0.0

HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8) 10.7.0.0 <= 10.7.2.2

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Xin'an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian, Zhaowei Tan,Srikanth V. Krishnamurthy from University of California, and Mathy Vanhoef from DistriNet, KU Leuven
.