HPE Fabric Composer flaws expose admin access and code execution
INCIBE-CERT reports that HPE disclosed 46 vulnerabilities in HPE Networking Fabric Composer, including three critical flaws that can grant administrative access or execute code without authentication.
One flaw uses passwords built into the command-line interface (CLI), letting a remote attacker gain administrator access without logging in. The other two allow unauthenticated code execution from an adjacent network: one bypasses authentication in the underlying operating system, while the other uses built-in credentials in a component.
HPE lists fixes in 7.4.1 or later for the 7.4.x branch and 7.3.5 or later for 7.3.x; versions outside support may also be affected. Restricting web and CLI management interfaces can narrow exposure, but does not remove it. If Fabric Composer sits on a reachable management network, a compromise can put control of that system at risk, and unsupported installations remain potentially exposed.