A potential security vulnerability has been identified in HP2910al-48G version W.15.14.0016.

published 2019-08-01 7y ago modified 2026-06-17 4mo ago also EUVD-2019-15005

cvss: 4.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits: 0; none known

A potential security vulnerability has been identified in HP2910al-48G version W.15.14.0016. The attack exploits an xss injection by setting the attack vector in one of the switch persistent configuration fields (management URL, location, contact). But admin privileges are required to configure these fields thereby reducing the likelihood of exploit. HPE Aruba has provided firmware updates to resolve the vulnerability in HP 2910-48G al Switch. Please update to W.15.14.0017.

Is CVE-2019-5401 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	4.8	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
NVD	2.0	3.5	AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

HP HP 2910-48G al Switch

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03944en_us
vendor-advisory

Sources

CVE List CVE-2019-5401
NVD CVE-2019-5401

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.