The Hewlett Packard Enterprise AOS-S network switch can be accessed without any login.

The switching software in HP Enterprise's AOS‑S has a programming mistake that could be tricked into running any code an attacker sends.

The HP AOS-S network switch contains flaws that let anyone on the network cause it to misbehave and run their own programs.

The AOS‑S software used in HP switches has a coding error that lets anyone on the network read parts of its memory and potentially make the switch stop.

The web‑based management console of HPE AOS‑S switches can be tricked into skipping its login checks under certain conditions.

The web management screen of HPE AOS‑S switches can be reached without providing valid credentials.

TL;DR HPE Networking has patched nine HPE AOS-Switch vulnerabilities, and six of them rate Critical. The worst let an unauthenticated attacker run code or bypass login on the switch. Admins should upgrade to AOS-S 16.11.0032 or later. Why It Matters AOS-Switch (AOS-S) runs on HPE Aruba campus and branch switches. These devices sit at the core of many enterprise networks. As a result, an attacker who takes over a switch could watch or redirect traffic.