CVE-2022-23681: Command Injection
Multiple vulnerabilities exist in the AOS-CX command line interface that could lead to authenticated command injection. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete switch compromise in ArubaOS-CX version(s): AOS-CX 10.09.xxxx: 10.09.1030 and below, AOS-CX 10.08.xxxx: 10.08.1030 and below, AOS-CX 10.06.xxxx: 10.06.0180 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address these security vulnerabilities.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23681?
The severity of CVE-2022-23681 is considered critical due to its potential to allow authenticated command injection leading to full system compromise.
How do I fix CVE-2022-23681?
To fix CVE-2022-23681, you should update your ArubaOS-CX software to the latest, patched version provided by Aruba Networks.
Which versions of ArubaOS-CX are affected by CVE-2022-23681?
CVE-2022-23681 affects ArubaOS-CX versions between 10.06.0000 and 10.10.0002, excluding later updates.
What could happen if CVE-2022-23681 is exploited?
If exploited, CVE-2022-23681 could allow an attacker to execute arbitrary commands as root, leading to complete compromise of the affected switch.
Is my device vulnerable to CVE-2022-23681?
To determine vulnerability to CVE-2022-23681, check if your device is running an affected version of ArubaOS-CX within the specified range.