CVE-2021-37722: Command Injection

Q: What is the vulnerability ID of the remote arbitrary command execution vulnerability in Aruba SD-WAN Software and Gateways?

The vulnerability ID is CVE-2021-37722.

Q: What is the severity level of CVE-2021-37722?

The severity level of CVE-2021-37722 is critical.

Q: Which software versions are affected by CVE-2021-37722?

Aruba SD-WAN Software versions prior to 8.6.0.4-2.2.0.4 and Aruba Operating System Software versions prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, and 6.4.4.25 are affected.

Q: Where can I find more information about CVE-2021-37722?

You can find more information about CVE-2021-37722 in the advisory published by Aruba Networks and the Siemens ProductCERT document.

Published Sep 7, 2021

Updated

A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.

Affected Software

11 affected components

Arubanetworks Sd-wan>=2.2.0.0<2.2.0.4

Arubanetworks Arubaos>=6.4.4.0<6.4.4.25

Arubanetworks Arubaos>=6.5.4.0<6.5.4.20

Arubanetworks Arubaos>=8.3.0.0<8.3.0.16

Arubanetworks Arubaos>=8.5.0.0<8.5.0.13

Arubanetworks Arubaos>=8.6.0.0<8.6.0.9

Arubanetworks Arubaos>=8.7.0.0<8.7.1.4

Siemens Scalance W1750d Firmware

Siemens SCALANCE W1750D

All of the following

Siemens Scalance W1750d Firmware

Siemens SCALANCE W1750D

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Aruba SD-WAN Software and Gateways (Aruba Operating System Software) to a version that resolves this vulnerability.
Fixed in 8.6.0.4-2.2.0.4
Upgrade
Upgrade Aruba SD-WAN Software and Gateways (Aruba Operating System Software) to a version that resolves this vulnerability.
Fixed in 8.7.1.4
Upgrade
Upgrade Aruba SD-WAN Software and Gateways (Aruba Operating System Software) to a version that resolves this vulnerability.
Fixed in 8.6.0.9
Upgrade
Upgrade Aruba SD-WAN Software and Gateways (Aruba Operating System Software) to a version that resolves this vulnerability.
Fixed in 8.5.0.13
Upgrade
Upgrade Aruba SD-WAN Software and Gateways (Aruba Operating System Software) to a version that resolves this vulnerability.
Fixed in 8.3.0.16
Upgrade
Upgrade Aruba SD-WAN Software and Gateways (Aruba Operating System Software) to a version that resolves this vulnerability.
Fixed in 6.5.4.20
Upgrade
Upgrade Aruba SD-WAN Software and Gateways (Aruba Operating System Software) to a version that resolves this vulnerability.
Fixed in 6.4.4.25

Event History

Sep 7, 2021

CVE Published

via MITRE·12:09 PM

Data Sourced

via MITRE·12:09 PM

DescriptionWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Oct 12, 58461

Event

12:13 AM

Frequently Asked Questions

What is the vulnerability ID of the remote arbitrary command execution vulnerability in Aruba SD-WAN Software and Gateways?

The vulnerability ID is CVE-2021-37722.

What is the severity level of CVE-2021-37722?

The severity level of CVE-2021-37722 is critical.

Which software versions are affected by CVE-2021-37722?

Aruba SD-WAN Software versions prior to 8.6.0.4-2.2.0.4 and Aruba Operating System Software versions prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, and 6.4.4.25 are affected.

How can I fix CVE-2021-37722?

Aruba has released patches for Aruba SD-WAN Software and Gateways to address CVE-2021-37722. It is recommended to apply the latest patches as soon as possible.

Where can I find more information about CVE-2021-37722?