CVE-2026-73778: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

This vulnerability exists in the Credential Manager of HPE AOS-CX devices. An attacker can remotely exploit the predictable factory-default password on devices that are in their factory-default or post-ZTP state, prior to any administrator configuration. This flaw enables unauthorized administrative access, potentially leading to full control of the device during the initial setup process. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The affected versions explicitly include 10.10.0000, 10.13.0000, 10.16.0000, 10.17.0000, and 10.18.0000.

An unauthenticated remote attacker can gain full administrative control of an HPE AOS-CX device during its initial setup phase by exploiting a predictable factory-default password. This compromises confidentiality, integrity, and availability of the device, potentially allowing complete device takeover before any legitimate administrator credentials are set.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, ensure that devices are not exposed in their factory-default or post-ZTP state on untrusted networks. Immediate configuration of administrator credentials upon device deployment is recommended to prevent exploitation.