Description

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A successful exploit allows an attacker to enumerate information about the internal structure of the AOS-CX host, leading to potential disclosure and limited modification of sensitive information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-01T21:18:42.337Z",
  "pubdate": "2026-09-01T21:18:42.337Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists within the web-based management interface of AOS-CX. This flaw allows an authenticated remote attacker to induce the management interface to perform unauthorized HTTP requests to internal network resources.\nThe vulnerability poses a significant risk to the integrity and confidentiality of the host environment. By leveraging the internal networking context of the AOS-CX device, an attacker can bypass traditional network perimeter defenses to probe internal services that are not typically exposed to the external network.\nThe impact includes the unauthorized enumeration of the internal infrastructure, potential disclosure of sensitive configuration data, and the ability to perform limited modifications to internal information. Exploitation requires the attacker to possess valid authentication credentials for the management interface. Given the administrative nature of AOS-CX, successful exploitation could provide an attacker with a foothold to conduct further lateral movement or information gathering within the management plane of the network infrastructure.",
  "technicalDetails": "The vulnerability resides within the web-based management interface of AOS-CX, specifically involving the improper validation of user-supplied input used in server-side HTTP request construction. An authenticated attacker can manipulate specific parameters within the management interface to force the device to act as an unintended proxy or requester.\nRoot Cause Analysis: The underlying issue stems from insufficient input sanitization and validation on the server side when processing requests. The application fails to adequately restrict the destination of requests initiated by the management service, allowing the attacker to specify arbitrary target URLs, including internal loopback addresses (127.0.0.1) or internal network subnets reachable by the device management plane.\nExploitation Method: An attacker with authenticated access to the web interface submits a crafted HTTP request containing malicious input parameters. These parameters are processed by the management service's back-end logic, which then initiates an outbound request to an attacker-specified destination using the privileges of the AOS-CX system service. This effectively bypasses the attacker's own network constraints.\nAttack Flow: 1. The attacker authenticates to the AOS-CX web management interface. 2. The attacker identifies a vulnerable interface parameter that influences back-end request generation. 3. The attacker crafts a request containing an internal URL (e.g., http://localhost:port or internal_server_ip). 4. The AOS-CX host processes the input and executes the request to the target resource. 5. The response or status information from the target resource is potentially reflected or processed by the attacker, facilitating reconnaissance or unauthorized actions.\nPost-Exploitation Impact: Beyond service enumeration, the SSRF primitive can be utilized to interact with internal APIs or management services that rely on implicit trust for requests originating from the localhost or management interface. This leads to the potential disclosure of administrative metadata and unauthorized modification of information, undermining the security posture of the network device. The ability to perform these actions is limited by the functional capabilities of the web service's existing request-handling logic but remains a critical risk factor for AOS-CX deployment security."
}