CVE-2026-73778

Analyzed Analyzed - Analysis Complete

Unauthorized Administrative Access via Predictable Credential in Credential Manager

Publication date: 2026-09-01

Last updated on: 2026-09-10

Assigner: Hewlett Packard Enterprise (HPE)

Description

A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could exploit this vulnerability on a device in its factory-default or post-ZTP state before any administrator has configured credentials by providing a predictable factory-default password. Successful exploitation could result in full administrative control of the affected device during the initial setup process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-10

Generated

2026-09-22

AI Q&A

2026-09-02

EPSS Evaluated

2026-09-20

NVD

CVE-2026-73778

Affected Vendors & Products

Vendor	Product	Version / Range
hpe	arubaos-cx	From 10.13.0000 (inc) to 10.13.1180 (inc)
hpe	arubaos-cx	to 10.10.1180 (inc)
hpe	arubaos-cx	From 10.16.0000 (inc) to 10.16.1051 (inc)
hpe	arubaos-cx	From 10.17.0000 (inc) to 10.17.1021 (inc)
hpe	arubaos-cx	10.18.0001

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-521	The product does not require that users should have strong passwords.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Credential Manager component and allows unauthorized administrative access. An attacker could exploit it on a device in factory-default or post-ZTP state before credentials are set by using a predictable factory-default password. Successful exploitation grants full administrative control during initial setup.

Detection Guidance

This vulnerability can be detected by checking if the device is in a factory-default or post-ZTP state without configured credentials. Verify if the device accepts predictable factory-default passwords during initial setup. No specific commands are provided in the context.

Impact Analysis

If exploited, an attacker could gain full administrative control of the affected device during its initial setup phase. This could lead to unauthorized configuration changes, data access, or system compromise before proper security measures are implemented.

Compliance Impact

This vulnerability could lead to unauthorized administrative access, potentially exposing sensitive data. For GDPR, this may result in unauthorized processing or access to personal data, violating principles of data protection and user consent. For HIPAA, it risks unauthorized access to protected health information, compromising confidentiality and integrity requirements.

Mitigation Strategies

Change the factory-default password immediately if the device is in its default state. Ensure all devices are configured with strong, unique administrative credentials before deployment. Disable remote access to administrative interfaces until credentials are properly set.

Hi! I’m here to help you understand CVE-2026-73778. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70