CVE-2022-37932

Deeper analysis

A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches that could be remotely exploited to allow authentication bypass. The affected devices are those running firmware versions prior to PT.02.14, PC.01.22, PO.01.21, or PD.02.22 respectively. The issue carries a CVSS 3.1 base score of 8.8 with an attack vector of adjacent network, low attack complexity, and no required privileges or user interaction, resulting in high impact to confidentiality, integrity, and availability.

An unauthenticated attacker with adjacent-network access can exploit the flaw to bypass authentication controls and obtain full administrative access to the switch. This would enable the attacker to read or modify device configuration and traffic data, disrupt network operations, or use the compromised switch as a pivot point into connected environments.

HPE advisory hpesbnw04383en_us states that the vulnerability is resolved by applying the listed firmware updates for each switch model. The associated EPSS score reached a peak of 0.7962 on 2026-02-03 before receding to its current value of 0.3670, indicating a period of elevated exploitation interest after disclosure.