CVE-2018-7084: OS Command Injection
A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system commands within the underlying operating system. An attacker could use this ability to copy files, read configuration, write files, delete files, or reboot the device. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.1
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-7084?
CVE-2018-7084 is a command injection vulnerability present in the Aruba Instant web interface, allowing an unauthenticated user to execute arbitrary system commands.
How does CVE-2018-7084 affect Aruba Instant?
CVE-2018-7084 affects Aruba Instant versions ranging from 4.0 to 4.2.4.12, 6.5.0 to 6.5.4.11, 8.3.0 to 8.3.0.6, and 8.4.0 to 8.4.0.1.
What can an attacker potentially do with CVE-2018-7084?
An attacker exploiting CVE-2018-7084 can perform actions like copying files, reading configuration, writing files, and deleting files on the underlying operating system.
How severe is CVE-2018-7084?
CVE-2018-7084 has a severity rating of 9.8 out of 10, making it critical.
How can I mitigate CVE-2018-7084?
To mitigate CVE-2018-7084, users should update their Aruba Instant software to a version that is not affected.