Hewlett Packard Enterprise (HPE) has disclosed a critical vulnerability in its Telco Service Activator software that exposes telecom networks to unauthorized access.
Tracked as CVE-2025-12543, the flaw stems from improper input validation in the underlying Undertow HTTP server core.
Attackers can exploit this by crafting malicious HTTP requests with tampered Host headers to bypass remote access restrictions.
HPE released security bulletin HPESBNW05011 on February 19, 2026, urging users to patch immediately. With a CVSS v3.1 base score of 9.6, this high-severity issue ranks among the most pressing telecom threats this year.
Vulnerability Details and Exploitation Risks
The vulnerability arises because the Undertow HTTP server, embedded in HPE Telco Service Activator, does not properly validate the Host header in incoming requests.
This allows remote attackers with no privileges to trick the server into processing unauthorized requests.
According to HPE’s bulletin, exploitation requires user interaction, such as tricking a victim into visiting a malicious site.
However, the attack vector remains network-accessible (AV: N), has low complexity (AC: L), and requires no prerequisites (PR: N).
The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A: L breaks down to high confidentiality and integrity impacts, plus low availability disruption, all under a changed scope (S: C).
In practice, successful exploits could allow attackers to access sensitive telecom configuration data, alter service activations, or pivot deeper into the network infrastructure.
Telecom operators rely on Telco Service Activator for provisioning and managing services across mobile and fixed networks, making it a prime target for disruption or espionage.
Only versions before 10.5.0 are affected. HPE confirmed no workarounds exist, emphasizing the need for swift upgrades.
The flaw echoes broader risks in HTTP parsing libraries, similar to past server misconfigurations that enabled request smuggling in tools like Apache or Nginx.
Telecoms face heightened risks here, as compromised activators could spread to billing systems, customer data, or even 5G core functions.
Patch, Mitigation, and Broader Implications
HPE resolves the issue with Telco Service Activator version 10.5.0, available via standard update channels. Users should verify their deployments against the supported versions list in the bulletin and apply patches in accordance with their policy.
For third-party components such as Undertow, HPE advises following vendor guidance. Organizations without immediate patching capability must isolate affected instances, monitor Host header anomalies in logs, and restrict external access via firewalls.
This disclosure highlights ongoing scrutiny of telco software stacks amid rising nation-state and cybercrime targeting of critical infrastructure.
HPE’s Product Security Response Team encourages reporting. Subscribers can stay updated through HPE’s bulletin archive.
Telecom providers should audit all HPE deployments now, especially at the edge and in orchestration layers.
Delayed patching risks service outages or data breaches, potentially violating regulations like GDPR or India’s DPDP Act. As 5G rollouts accelerate, such flaws underscore the need for rigorous input validation in service management tools.
In summary, CVE-2025-12543 demands priority action to safeguard telecom resilience.
| CVE ID | CVSS Score | Description |
|---|---|---|
| CVE-2025-12543 | 9.6 (v3.1) | Improper input validation in Undertow HTTP server allows Host header bypass for unauthorized remote access. |
Affected and Patched Versions
| Component | Affected Versions | Patched Version |
|---|---|---|
| HPE Telco Service Activator | <10.5.0 | 10.5.0 |
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 has disclosed a critical vulnerability in its Telco Service Activator software that exposes telecom networks){kind=link}