HPE Networking Product Public Program

Description

HPE Networking is dedicated to security research, and we look forward to working with the working with you to help secure our products. We will pay bounties for valid, impactful vulnerabilities in our networking product lines. For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood, impact, or underlying risk to HPE Networking. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority. If you do not have access to the Networking Support Portal, please refer to our publicly available software images at https://ln5.sync.com/dl/7af99bb50#5cw6qt88-5z97mbwv-hvunmbw4-paykvidg For vulnerability submissions against our infrastructure (*.hpe.com and other domains), please use the HPE Hackerone program at https://hackerone.com/hpe_vdp .

Targets

Any HPE Aruba Networking products, assets, or hosts not listed as "in-scope", are thereby out-of-scope. Increased bounties will be paid on findings against AOS-10, AOS-CX, and the new HPE Aruba Networking Central. Software images on applicable products where available can be found in respective categories below. Target Information: For vulnerabilities discovered in one software branch and later found replicated in another branch of the same product, we reserve the right to treat them as duplicate findings. As such, only the original submission will be eligible for a bounty, and no additional reward will be granted for the duplicate. HPE Aruba Networking Wireless – AOS-10.7 and later Increased Rewards The AOS-10 Virtual Gateway can be run as a virtual machine by downloading the 10.7.x OVA at https://ln5.sync.com/dl/5ad62de10#bvefcjzk-uawzt3im-682mvu62-axihc3qj . There is other 10.x firmware available for examination as well. Pair it with your HPE Aruba Networking Central account by following the documentation at https://arubanetworking.hpe.com/techdocs/central/2.5.8/content/aos10x/cfg/aps/aos10-conf_ap.htm . Note - we require the switch to be connected to HPE Aruba Networking Central. Reports that use VGWs that have been "jailbroken" will need to use a physical controller (you can get an old one on eBay for cheap) or use an AOS-8 VMC. Product Documentation is available at https://networkingsupport.hpe.com/globalsearch#tab=Documents&f-sfproductqueue=Access%20Points,Mobility%20Gateways . AOS-10 Gateways and Access Points require physical hardware to test, which we can unfortunately not provide, but you should feel free to reverse engineer firmware images in order to submit findings. Non-exploitable vulnerabilities discovered through static analysis alone will be rejected. We will pay increased bounties for findings on 10.7.x and later versions. We will also accept findings on 10.4.x, but with our standard bounties. Other versions may not be accepted at our discretion due to end-of-life issues. If you have any questions, please open a request with [email protected] and we will do our best to assist you. HPE Aruba Networking Wireless – AOS-8 and Aruba Instant The AOS-8 Virtual Gateway can be run as a virtual machine by downloading the AOS-8 OVAs found at https://ln5.sync.com/dl/5ad62de10#bvefcjzk-uawzt3im-682mvu62-axihc3qj AOS-8 Gateways and Access Points require physical hardware to test, which we can unfortunately not provide, but you should feel free to reverse engineer firmware images in order to submit findings. Non-exploitable vulnerabilities discovered through static analysis alone will be rejected. The latest LSR is 8.13.x.x and we would prefer it if your submission was on that version. Documentation is available at: https://networkingsupport.hpe.com/globalsearch#tab=Documents&f-sfproductqueue=Access%20Points,Mobility%20Gateways We will accept vulnerabilities from AOS-8 versions published at the firmware link shared above with our standard bounties. Other versions may not be accepted at our discretion due to end-of-life issues. If you have any questions, please open a request with [email protected] and we will do our best to assist you. HPE Aruba Networking CX Wired Switch Series and AOS-CX Increased Rewards An AOS-CX Switch simulator can be run as a virtual machine by downloading the OVA at https://ln5.sync.com/dl/983c21430#hz7kuqsh-abef6rii-259d49v5-5f343sdd Note: Any vulnerabilities requiring the use of the start-shell command will not be accepted. The AOS-CX Wired Switches require the physical hardware to test in most instances, but you should feel free to reverse engineer firmware images in order to submit findings. As noted above an OVA is also provided and findings against this OVA will also be accepted as we realize most researchers will not have access to physical hardware. Non-exploitable vulnerabilities discovered through static analysis alone will be rejected without some proof of concept. Documentation is available at: https://networkingsupport.hpe.com/globalsearch#tab=Documents&f-sfproductqueue=Switches . We will accept vulnerabilities from AOS-CX versions published at the firmware link shared above Other versions may not be accepted at our discretion due to end-of-life issues If you have any questions, please open a request with [email protected] and we will do our best to assist you. HPE Aruba Networking Central and related support sites Increased Rewards We are most interested in vulnerabilities on our new Central. We will accept P1-P4 vulnerabilities on new Central. How to enable new central: After logging into Central, select the "New Central" slider in the top right. Please note that we are only interested in P1 and P2 severity vulnerabilities on “old” Central. Submissions should be focused on HPE Aruba Networking Central. As a cloud service there are many sites that may look associated with Central, but which are part of the greater HPE Greenlake Cloud Platform. Submissions against these hosts may not be accepted based upon our discretion. Questions about the applicability of a particular submission can be directed to [email protected]. HPE Aruba Networking ClearPass Policy Manager and related client software Versions should be 6.12.x or 6.11.x if possible. Other versions may not be accepted at our discretion due to end-of-life issues. Documentation is available at: https://networkingsupport.hpe.com/globalsearch#tab=Documents&f-sfproductqueue=ClearPass%20Policy%20Manager Related client applications include HPE Aruba Networking VIA, Onguard, and Onboard and are eligible for bounty. If you have any questions, please open a request with [email protected] and we will do our best to assist you. HPE Aruba Networking Private 5G The HPE Aruba Networking Private 5G products require the physical hardware to test, but you should feel free to reverse engineer firmware images in order to submit findings. Documentation is available at: https://support.hpe.com/connect/s/product?kmpmoid=1014769364&language=en_US https://support.hpe.com/connect/s/product?kmpmoid=1014769362&language=en_US HPE Aruba Networking SSE Documentation is available at: https://support.hpe.com/connect/s/product?language=en_US&kmpmoid=1014795496&tab=manuals&cep=on HPE Networking Aruba Instant On The HPE Networking Aruba Instant On Access Points require the physical hardware to test, but you should feel free to reverse engineer firmware images in order to submit findings. HPE Networking Aruba Instant On Switches are not eligible for bounty. Documentation is available at: https://community.instant-on.hpe.com/support/instant-on-resources . If you have any questions, please open a request with [email protected] and we will do our best to assist you. HPE Aruba Networking Management Software (AirWave) Documentation is available at: https://networkingsupport.hpe.com/globalsearch#tab=Documents&f-sfproductqueue=AirWave . Versions should be 8.3.0.4 if possible. Other versions may not be accepted at our discretion due to end-of-life issues. No bounties are awarded for vulnerabilities on HPE Aruba Networking Management Software (AirWave), but you may still receive points and a CVE. If you have any questions, please open a request with [email protected] and we will do our best to assist you. HPE Aruba Networking User Experience Insight (UXI) Sensors The User Experience Insight Sensors require the physical hardware to test, but you should feel free to reverse engineer firmware images in order to submit findings. We will also accept submissions against the user portal for UXI sensors located at https://dashboard.capenetworks.com/login Documentation is available at: https://networkingsupport.hpe.com/globalsearch#tab=Documents&f-sfproductqueue=User%20Experience%20Insight%20(UXI) . If you have any questions, please open a request with [email protected] and we will do our best to assist you. HPE Aruba Networking EdgeConnect Enterprise and EdgeConnect Enterprise Orchestrator These are former Silver Peak products that are now part of HPE Aruba Networking's product offerings. Documentation can be reviewed at https://networkingsupport.hpe.com/globalsearch#tab=Documents&f-sfproductqueue=EdgeConnect%20SD-WAN,EdgeConnect%20WAN%20Optimization If you have any questions, please open a request with [email protected] and we will do our best to assist you. HPE Aruba Networking Fabric Composer Feel free to submit vulnerabilities on the latest version. Documentation is available at: https://networkingsupport.hpe.com/globalsearch#q=Fabric%20Composer&tab=Documents HPE Aruba Networking NetEdit Feel free to submit vulnerabilities on the latest version. Documentation is available at: https://networkingsupport.hpe.com/globalsearch#q=netedit&tab=Documents Additional Support Link: https://networkingsupport.hpe.com/ Focus Areas: As stated above, discoveries on AOS-10, AOS-CX, and the “new” Aruba Central will see increased reward amounts for a limited time. Attack scenarios where you can bypass input validation to achieve code execution. Attack scenarios where you can bypass authentication to access underlying system functions Attack scenarios where you can access other user’s sensitive information It is recommended tests are performed in the latest version of software/ firmware available. Older versions of software that are not End of Life/ Support are also in scope. For more information about what versions are End-of-Life visit https://networkingsupport.hpe.com/notifications;notificationSortBy=announcementDate;notificationCategory=Product%20End%20of%20Life;notificationSearchText=; . Out-of-Scope HPE corporate websites and resources. Other HPE or HPE Aruba Networking products not specifically listed in one of the in-scope target groups. Rate limiting or other DoS type attacks for any HPE Aruba Networking hosts Open redirects link injection will be considered but impact might be reduced depending on site Any DMARC findings or similar without demonstrated proof of impact. A lot of arubanetworks.com subdomains actually do not accept email modern day, although historically they did. Infrastructure with certificates like instant.arubanetworks.com or hostnames like securelogin.arubanetworks.com/securelogin.hpe.com. These are products owned by customers which are not setup and they are not owned by HPE Aruba Networking nor are they externally facing infrastructure. Any *.arubanetworks.com host not specifically listed as in scope above Reflected XSS on *.cloudguest.central.arubanetworks.com. Other vulnerabilities on those hosts are still accepted. Authenticated DoS requiring admin permissions Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via our Freshdesk Portal before going any further. Disclosure: At the current time, HPE Aruba Networking has chosen to not participate in the Bugcrowd's coordinated disclosure program. However, we do support disclosure from our programs based upon the following guideline: HPE Aruba Networking handles and discloses vulnerabilities in accordance with ISO/IEC 30111. Public disclosure of vulnerabilities will generally take place only after permanent fixes are available. Where the vulnerability occurs in multiple branches of software, or in multiple software products, HPE Aruba Networking will publish advisories once the last branch or product is updated and released. However, if HPE Aruba Networking learns that information about an unpublished vulnerability is being communicated externally, a vulnerability advisory will be published immediately along with details of any possible workaround or defense. In the case of vulnerabilities in open-source software that are being publicly discussed, HPE Aruba Networking will immediately issue a security advisory once it has been determined that the vulnerability affects an HPE Aruba Networking product. The initial vulnerability advisory will consist of general information about the vulnerability, workarounds, and steps to resolve the vulnerability. The public advisory is the only information that HPE Aruba Networking will provide to anyone for the first 60 days. After 60 days HPE Aruba Networking may, at its sole discretion, make public full details about the vulnerability. Security researchers who wish to publicize HPE Aruba Networking vulnerability details (e.g. in a blog or at a conference) are asked to wait for the same 60-day period after an advisory has been published. As a courtesy, we request you inform HPE Aruba Networking that such presentation will be given. Disclosure is not selective under any circumstances. It is HPE Aruba Networking’s policy to notify all customers of vulnerabilities at the same time. No HPE Aruba Networking customer, partner, or third-party is given advance notification or additional details of a vulnerability. HPE Aruba Networking’s OEM partners are generally notified three days in advance of public disclosure to allow their respective security response teams to prepare for notification of their own customers. HPE Aruba Networking’s OEM partners have agreed contractually to coordinate vulnerability notifications with HPE Aruba Networking so that all end users are alerted at the same time. HPE Aruba Networking’s customer-facing employees (TAC, SE, etc.) are provided a copy of the advisory approximately 18 hours before public disclosure, but are prohibited from sharing that information until it is officially released. OEM partners and customer-facing employees are only given a copy of the public advisory; they are not provided with full details of a vulnerability.

HPE Aruba Networking Target Group 1 (in scope)

HPE Aruba Networking Target Group 1 are higher priority and will be paying additional bounties compared to Group 2. See Scope Details for relevant VMs.

HPE Aruba Networking Target Group 2 (in scope)

HPE Aruba Networking Target Group 2 will pay cash rewards for all valid submissions.

Aruba Central - Old/Original UI (in scope)

For the time being, we will only be accepting high and critical severity submissions for Aruba Central's old UI. This is due to the old UI being deprecated and replaced by the end of 2025.

HPE Aruba Networking Target Group 3 (in scope)

Monetary rewards are currently unavailable. We still welcome valid submissions, and eligible findings may receive CVEs with full credit to the reporter.

HPE Aruba Networking Out of scope (out of scope)

Submissions related to *.arubanetworks.com that are not in scope above (i.e. *.central.arubanetworks.com is in scope, but www.arubanetworks.com is out of scope). Please use the HPE Hackerone program at https://hackerone.com/hpe_vdp . https://action.arubainstanton.com is out of scope. Reflected XSS on *.cloudguest.central.arubanetworks.com. Other vulnerabilities on those hosts are still accepted. Infrastructure with certificates like instant.arubanetworks.com or hostnames like securelogin.arubanetworks.com/securelogin.hpe.com. These are products owned by customers which are not setup and they are not owned by HPE Aruba Networking nor are they externally facing infrastructure.