CVE-2026-23810

Katalog CVE

CVSS 3.1 · Low EPSS 0,19%

Kerentanan Channel Accessible by Non-Endpoint pada arubanetworks arubaos. Skor CVSS 3.1 3.1 (Low) menurut NVD.

Deskripsi (NVD)

A vulnerability in the packet processing logic may allow an authenticated attacker to craft and transmit a malicious Wi-Fi frame that causes an Access Point (AP) to classify the frame as group-addressed traffic and re-encrypt it using the Group Temporal Key (GTK) associated with the victim's BSSID. Successful exploitation may enable GTK-independent traffic injection and, when combined with a port-stealing technique, allows an attacker to redirect intercepted traffic to facilitate machine-in-the-middle (MitM) attacks across BSSID boundaries.

Rincian

Terbit di NVD

4 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.1 (Low), sumber NVD
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-300: Channel Accessible by Non-Endpoint

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05026en_us&docLocale=en_US advisory vendor