CVE-2026-23813 — AOS-CX Pre-Auth Authentication Bypass

Unauthenticated remote attackers can reach the AOS-CX management REST API by smuggling a login token through nginx's over-permissive version regex, exposing the OVSDB-backed configuration surface (including the hashed admin credential).

• CVE: CVE-2026-23813
• CWE-287 · CVSS 9.8 (Critical)
• Vendor: HPE Aruba Networking · Product: AOS-CX
• Write-up: offseckit.com/blog/cve-2026-23813

Affected versions

Branch	Vulnerable	Fixed
10.17.x	≤ 10.17.0001	10.17.1001
10.16.x	≤ 10.16.1020	10.16.1030
10.13.x	≤ 10.13.1160	10.13.1161
10.10.x	≤ 10.10.1170	10.10.1180

Quick start

Check if a device is patched (defenders)

python3 detect.py <host[:port]>

Sends one read-only GET. Prints PATCHED, VULNERABLE, or UNKNOWN. Makes no changes. Suitable for inventory sweeps.

Understand the bypass (researchers)

python3 bypass_demo.py <host[:port]>

Sends the same endpoint twice — once normally, once with the smuggle — and prints the response codes side-by-side. No state change. See docs/root-cause.md for the why.

Demonstrate impact on 10.10.x (authorized testing only)

python3 exploit.py <host[:port]>

AOS-CX 10.10.x only. Creates a checkpoint via the unauthenticated path, reads the full running config, prints the admin hash. The cross-branch bypass works on every affected version, but this config-disclosure chain relies on backend behavior specific to the 10.10 branch. The checkpoint persists on the device — the REST endpoints reachable via the bypass do not accept DELETE; remove it via console / authorized session if needed.

Files

File	Purpose
detect.py	Non-destructive patch-status check
bypass_demo.py	Educational side-by-side of the bypass mechanic
exploit.py	Config-disclosure PoC (creates a checkpoint)
detection/nginx-access.md	Log signatures for nginx access logs
detection/suricata.rules	Suricata rule for the smuggle URI shape
docs/root-cause.md	Short root-cause explainer
docs/patch-diff.md	The fix, in one diff

Requirements

Python 3.8+ and requests:

pip install requests

Credits

Independent post-patch analysis and PoC by 4252nez — write-up on OffSecKit. Original vulnerability reported by moonv via the HPE Bugcrowd program; this repository has no affiliation with that report.

License

MIT — see LICENSE.