# HPESBNW05162: HPE Networking AOS-8 / AOS-10 detection pack

**Bulletin:** HPESBNW05162 rev.1, released 22 Oct 2026 (CSAF timestamp 2026-10-22T16:00Z, i.e. 17:00 BST).
**Title:** Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-8 and AOS-10) for Mobility Conductors, Controllers, Gateways, and Access Points.

Primary sources (the only sources used):
- HPE bulletin: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- HPE CSAF: https://csaf.arubanetworking.hpe.com/2026/hpe%5Fnetworking%5F-%5Fhpesbnw05162.json (copy: `sources_hpesbnw05162_csaf.json`)
- CISA KEV JSON feed (checked for exploitation status)

## Scope
- 72 CVEs. Eight are CVSS 10.0 (CVE-2026-79844 to -79851: auth bypass, command injection, SQLi, buffer overflows).
- Scores range from 10.0 down to 3.3. The 9.3 to 9.8 Critical band (which includes 9.4 and 9.6 items) includes PAPI (UDP 8211) RCE (CVE-2026-79857, -79860, -79861) and an AOS-8 SSH daemon auth bypass (CVE-2026-79855, 9.8).
- **Source inconsistency:** CVE-2026-79881 has three different scores in HPE's own documents: 8.5 (bulletin details, AV:N/AC:H/UI:R), 8.3 (bulletin score table, same vector) and 9.6 (CSAF, AV:A/AC:L). Treat its score as unconfirmed.
- Affected platforms: Mobility Conductors, Mobility Controllers, Mobility Gateways (Central-managed), AOS-10 APs, AOS-8 Instant APs, and any hardware or VM running an affected version.

## Affected / fixed versions
| Train | Affected | Fixed |
|---|---|---|
| AOS-10.8.x.x | 10.8.1.1 and below | 10.8.1.2 and above |
| AOS-10.7.x.x | 10.7.2.6 and below | 10.7.2.7 and above |
| AOS-10.4.x.x | 10.4.1.13 and below | 10.4.1.14 and above |
| AOS-8.13.x.x | 8.13.3.0 and below | 8.13.3.1 and above |
| AOS-8.10.x.x | 8.10.0.23 and below | 8.10.0.24 and above |

The CSAF ranges are wider than the bulletin's train names: `>=10.3.0.0 <=10.4.1.13`, `>=10.6.0.0 <=10.7.2.6`, `>=10.8.0.0 <=10.8.1.1`, `>=8.10.0.0 <=8.10.0.23`, `>=8.12.0.0 <=8.13.3.0`. So 10.3.x, 10.6.x and 8.12.x are in scope, and the fix for them is to move to a fixed train.

**End-of-life releases:** HPE says releases past End of Maintenance (EoM) are *presumed affected*. Releases past End of Support (EoS) have *not been assessed* and "should be considered potentially impacted".

## Exploitation status
- HPE: "not aware of any public discussion or exploit code" at release. Most issues were found by HPE's internal research.
- CISA KEV: none of these CVEs were listed in the feed as checked (catalog 2026.10.21, which pre-dates the bulletin; re-check).
- **IOCs: HPE published none. This pack contains no IOCs.**

## Mitigations (HPE)
1. Upgrade to a fixed version (table above) from https://networkingsupport.hpe.com.
2. Workaround from HPE: restrict CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and/or control them with firewall policies at layer 3 and above. Also use accounting controls to track and log user activity and resource usage.
3. EoM/EoS releases: upgrade to a supported release.
- *Pack guidance, not from HPE:* HPE's workaround doesn't mention PAPI. Making sure UDP 8211 only reaches controllers from AP and controller subnets is sensible defence-in-depth, but HPE hasn't stated that it is sufficient.

## Contents
| Path | Purpose |
|---|---|
| `kql/hpesbnw05162_hunts.kql` | Sentinel/Defender hunts: admin logins, new accounts, config changes, reboots/crashes, PAPI/SSH/WebUI traffic from outside `MgmtSubnets`, outbound connections from controllers. **Not run against a live tenant.** |
| `sigma/*.yml` | 4 Sigma rules (validated with `sigma check`; converted cleanly with the Kusto backend). |
| `checkers/check_aos_version.sh` | Bash checker (read-only). |
| `checkers/Check-AosVersion.ps1` | PowerShell checker (read-only). |
| `tests/` | Mocked fixtures, bash tests, Pester tests, `run_all.sh`. |

**Unverified:** the syslog keywords in the KQL and Sigma rules ("logged in", "mgmt-user", "crash", etc.) are generic heuristics. They have not been checked against HPE's AOS syslog message reference or real device logs. Tune them before you rely on them.

## Checkers
Both checkers are strictly offline. They parse a pasted `show version`, a version string or a CSV, and they never contact a device. They don't probe PAPI and contain no exploit payloads.
```
checkers/check_aos_version.sh --version "ArubaOS (MODEL: 7210), Version 8.10.0.23"
checkers/check_aos_version.sh --stdin < show_version.txt
checkers/check_aos_version.sh --csv inventory.csv          # needs 'version' column; 'hostname' optional
pwsh checkers/Check-AosVersion.ps1 -VersionText (Get-Clipboard -Raw)
pwsh checkers/Check-AosVersion.ps1 -CsvPath inventory.csv
```
Verdict logic:
- Listed train, at or above the fixed version → **PATCHED**. Below it → **LIKELY VULNERABLE**.
- Unlisted AOS-10 train below 10.8, or AOS-8 train below 8.13 (e.g. 8.11, 8.12, 10.3, 10.5, 10.6, older): it is either in a CSAF affected range or EoM/EoS, which HPE presumes affected or potentially impacted → **LIKELY VULNERABLE**.
- Newer, not-yet-assessed trains (e.g. 10.9, 8.14), non-AOS-8/10 versions, or unparseable input → **UNKNOWN**.

Exit codes: 0 = all PATCHED, 1 = any LIKELY VULNERABLE, 2 = any UNKNOWN and none vulnerable, 3 = error.

## Tests
Run `tests/run_all.sh`. It runs shellcheck, 35 bash tests, 34 Pester tests and `sigma check`.

## Credit
Built by the CybaVerse threat hunt team from HPE bulletin HPESBNW05162 and its CSAF record. No third-party research is included.