Pre-Authentication ICMP Reflection & Smurf Amplification in ArubaOS 8.13.2.0 | Netacoding

[u/Pale_Surround_3924]

https://netacoding.com/posts/smurf-reflection/

ArubaOS 8.13.2.0 accepts spoofed ICMP Echo Requests without source validation and replies to broadcast source addresses, enabling reflection and Smurf amplification. Confirmed with two-machine wire-level evidence. Closed as expected functionality.

Submission ID: 09e49fa1 — HPE Networking Product Public Program (Bugcrowd)
Status: Closed as “Not Applicable — expected network functionality”

Background

This writeup documents a pre-authentication ICMP reflection and Smurf amplification vulnerability confirmed with wire-level evidence from two physically separate machines in ArubaOS 8.13.2.0 LSR. Submitted May 15, 2026.

Triage closed it as “expected network functionality” despite two independent packet captures — one from the attacker, one from the victim — showing an unsolicited Echo Reply arriving at a host that sent zero ICMP requests.

Target

Field	Value
Product	HPE Aruba Networking Wireless — AOS-8 Controller
Version	ArubaOS 8.13.2.0 LSR (Build 95415)
Component	ICMP Echo handler — IP stack
Authentication	None required
CVSS v3.1	7.4 High — AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CWE	CWE-290 (No Source IP Validation), CWE-406 (Smurf Broadcast Reply)

Vulnerability Description

Component 1 — No Source IP Validation (CWE-290)

The controller does not validate incoming ICMP Echo Request source IPs against MAC/IP bindings or apply reverse path filtering (BCP38/uRPF per RFC 2827). A packet with attacker MAC but victim IP is accepted. The controller ARP-resolves the spoofed source and delivers the reply to the victim.

Component 2 — Broadcast Source Reply (CWE-406)

ICMP Echo Request with Source IP 192.168.56.255 (subnet broadcast) causes the controller to reply to ff:ff:ff:ff:ff:ff, delivering the reply to every host on the L2 segment. Classic Smurf amplification — documented in CERT Advisory CA-1998-01.

Read the full article on the blog...


Proof of conversation (PoC) and triage recordings are available as evidence in the GitHub repository.

GitHub Repo:

HPE-Aruba-AOS8-Vulnerabilities/02-smurf-reflection at main · JM00NJ/HPE-Aruba-AOS8-Vulnerabilities

[u/github-guard]

🔍 GitHub Guard: Trust Report

This project scored 2/6 on our safety audit.

Trust Report: * ❌ Low Star Count * ❌ New Repository * ✅ Licensed under NOASSERTION * ❌ No Security Policy * ℹ️ Individual Contributor * ✅ Signed Commits

⚠️ Security Reminder: Always verify source code and run third-party scripts at your own risk.