CVE-2026-73778: Vulnerability in Hewlett Packard Enterprise (HPE) AOS-CX

This vulnerability exists in the Credential Manager component of HPE AOS-CX devices. An unauthenticated remote attacker can exploit the predictable factory-default password on devices in factory-default or post-ZTP state before administrator credentials are set. Successful exploitation grants full administrative control of the device during initial setup. The vulnerability is identified as CWE-521 (Use of Hard-coded Password). The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction. Affected versions include exactly 10.10.0000, 10.13.0000, 10.16.0000, 10.17.0000, and 10.18.0000.

An attacker can gain full administrative control over affected HPE AOS-CX devices during their initial setup phase by exploiting a predictable factory-default password. This compromises confidentiality, integrity, and availability of the device. The attack requires no prior authentication and can be performed remotely, but only before any administrator credentials are configured.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, ensure that devices are not exposed in factory-default or post-ZTP states on untrusted networks. Configure administrative credentials immediately after device deployment to prevent exploitation.