CVE-2026-73770: Authenticated Arbitrary File Write Vulnerability Leading to Remote Code Execution in AOS-CX
An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, under specific conditions outside the attacker's control and following a required action by another user, to create or modify arbitrary files and execute arbitrary commands as a privileged user on the underlying operating system.
Affected Software
Event History
Frequently Asked Questions
What access must an attacker have to attempt exploitation?
The attacker must already be authenticated with high privileges and have adjacent-network access to the affected AOS-CX system. Exploitation also requires an action by another user.
Is exploitation entirely under the attacker’s control?
No. Successful exploitation depends on specific conditions that are outside the attacker’s control, in addition to the required action by another user.
What is the potential security impact if exploitation succeeds?
An attacker could create or modify arbitrary files and execute arbitrary commands as a privileged user on the underlying operating system. The supplied severity vector indicates high impacts to confidentiality, integrity, and availability, with a scope change.