CVE-2022-23684: High severity aruba networks aos-cx vulnerability
A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only privileges to escalate their permissions to those of an administrative user. Successful exploitation of this vulnerability allows an attacker to escalate privileges beyond their authorized level in ArubaOS-CX Switches version(s): AOS-CX 10.09.xxxx: 10.09.1020 and below, AOS-CX 10.08.xxxx: 10.08.1060 and below, AOS-CX 10.06.xxxx: 10.06.0200 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address this security vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23684?
CVE-2022-23684 has been rated as a critical vulnerability due to the potential for privilege escalation.
How do I fix CVE-2022-23684?
To fix CVE-2022-23684, you should upgrade the AOS-CX software to a version that is not affected, specifically beyond 10.09.1030.
Who is affected by CVE-2022-23684?
CVE-2022-23684 affects users of the Aruba Networks AOS-CX software versions between 10.06.0000 and 10.09.1030.
Can CVE-2022-23684 be exploited without authentication?
No, CVE-2022-23684 requires the attacker to be authenticated with read-only privileges to exploit the vulnerability.
What types of devices are impacted by CVE-2022-23684?
CVE-2022-23684 impacts various Aruba Networks AOS-CX models including those running affected versions of the AOS-CX operating system.