CVE-2008-7023: Critical severity aruba networks mcr-hw-1k vulnerability
Aruba Mobility Controller running ArubaOS 3.3.1.16, and possibly other versions, installs the same default X.509 certificate for all installations, which allows remote attackers to bypass authentication. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-7023?
CVE-2008-7023 is considered a critical vulnerability as it allows remote attackers to bypass authentication.
How do I fix CVE-2008-7023?
To fix CVE-2008-7023, ensure that you replace the default X.509 certificate with a unique certificate during the setup of the Aruba Mobility Controller.
What versions of ArubaOS are affected by CVE-2008-7023?
CVE-2008-7023 specifically affects ArubaOS version 3.3.1.16, but may impact other versions if the default certificate is used.
Can CVE-2008-7023 be exploited remotely?
Yes, CVE-2008-7023 can be exploited remotely by attackers who can access the Aruba Mobility Controller.
Is there a workaround for CVE-2008-7023?
The primary workaround for CVE-2008-7023 is to immediately replace the default X.509 certificate to enhance security.