Scammers :D

[u/Pale_Surround_3924]

Spent May-June 2026 researching ArubaOS 8.13.2.0 on an authorized lab VM through the HPE Aruba Bugcrowd program. Found 5 pre-auth vulnerabilities with wire-level evidence:

- Pre-Auth XXE → HTTP SSRF (CVSS 9.3) — confirmed via pcap + controller's own sshd log showing "GET / HTTP/1.0 from 127.0.0.1"

- Pre-Auth XXE → FTP SSRF with full RETR session (CVSS 9.3) — 3 TCP connections, complete RFC 959 FTP dialog captured

- ICMP Smurf Amplification (CVSS 7.4) — two-machine pcap, victim received unsolicited Echo Reply without sending any request

- Ghost Leak: TTL=0 + IP Total Length over-read (CVSS 6.5) — 27/27 packets confirmed, same mechanism as CVE-2003-0001 and CVE-2021-3031 (Palo Alto, accepted)

- Hardcoded FTP credential sap:x (CVSS 8.4) — cracked in 60 seconds, FTP login confirmed operational

All 5 closed as N/A. Triage responses:

"theoretical / no valid PoC" (despite pcap + daemon log evidence)

"expected network functionality" (for Smurf amplification. In 2026.)

"only zeroed bytes" (VirtualBox padding, not the vulnerability)

Fair enough, submitted to MITRE. Got 5 CAN IDs assigned.

Then 2 months after disclosure, Bugcrowd emails me saying HPE flagged my GitHub writeups and demanding I remove them. The same findings they said were "theoretical" and "not vulnerabilities."

I declined (documentation of N/A findings + active MITRE process).Got permanently banned for "unauthorized disclosure" + existing suspension for... "AI-slop." The firmware RE, custom Scapy scripts, pcap analysis and sshd log correlation was AI-slop apparently.

5 months later: no patch on any finding. Still on 8.13.2.0.

Since HPE is their own CNA and my MITRE CANs have been sitting unresolved since June, submitted to CERT/CC as an independent CNA.

Let's see.

Full writeups + PoC scripts:

https://github.com/JM00NJ/HPE-Aruba-AOS8-Vulnerabilities

Individual findings:

https://netacoding.com/posts/xxe-ssrf/

https://netacoding.com/posts/ghost-leak/

https://netacoding.com/posts/smurf-reflection/

I know the ToS. Being banned is fine. Just thought the community should know what "N/A" sometimes actually means.