CVE-2026-73778 is a high severity (CVSS 8.1) weak credential flaw in the AOS-CX Credential Manager. A switch in its factory default or post-ZTP state, before any administrator sets credentials, accepts a predictable default password. Configure credentials promptly and follow HPE bulletin hpesbnw05134en_us.
What's affected
The same HPE Aruba CX switch models as CVE-2026-73749, including the CX 10000 and CX 10040 families and the CX 4100i. The record describes the exposure as limited to a device in its factory default state, or in the state after zero touch provisioning (ZTP), before an administrator has configured credentials.
The record gives no version numbers. HPE bulletin hpesbnw05134en_us holds the affected and fixed releases, and I could not read it as text, so check it directly.
How to check if you're exposed
Inventory switches that are new, being re-provisioned or reset, since those are the ones in the window. For each switch, confirm that an administrator password has been set.
On a configured switch, you can check the software version.
show version
Compare the result with the bulletin.
What to do now
- Set administrator credentials during or immediately after provisioning, before connecting the switch to a reachable network.
- Keep switches in staging or on an isolated network until they are configured.
- Read HPE bulletin hpesbnw05134en_us and upgrade to the fixed software.
- Audit switches provisioned recently for default credentials.
- Include a credentials check in your switch deployment checklist.
Why it matters
The record maps this to CWE-521, weak password requirements. The behavior is a predictable default password that works in the short time before an administrator takes over the device. The result, according to the record, is full administrative control during initial setup.
The window is small but real: switches wait in warehouses, on racks and on provisioning networks. The practical defense is process. Never put an unconfigured device on a network that others can reach. The record gives a high attack complexity in its vector, since the attacker has to hit that window, and the KEV flag is false.
Quick check
Does this affect switches that are already configured?
The record describes the factory default or post-ZTP state before credentials are set, so configured switches are not the target of this issue.
Sources
Last reviewed: 19 October 2026.
