title: PAPI, SSH Or WebUI Traffic To Aruba Controllers From Outside Management Segment (HPESBNW05162)
id: 5a9e0c3d-7f21-4b8a-9e64-2c1d8b7f4e23
status: experimental
description: |
  Firewall telemetry showing UDP 8211 (PAPI), TCP 22 or TCP 443/4343/80 to controller IPs from
  sources outside the management segment. HPE recommends restricting CLI and web management to a
  dedicated L2 segment/VLAN or L3+ firewall policy. Replace the example controller IPs and the
  management subnet (10.10.0.0/24) with your own values; add AP subnets for expected PAPI.
references:
  - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
author: Oliver Spence
date: 2026-10-23
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: firewall
detection:
  controllers:
    dst_ip:
      - '10.20.0.10'
      - '10.20.0.11'
  papi:
    dst_port: 8211
  mgmt_tcp:
    dst_port:
      - 22
      - 443
      - 4343
      - 80
  mgmt_segment:
    src_ip|cidr: '10.10.0.0/24'
  condition: controllers and (papi or mgmt_tcp) and not mgmt_segment
falsepositives:
  - Access points legitimately using PAPI; jump hosts outside the listed segment
level: high