CVE-2022-23691: Medium severity aruba networks aos-cx vulnerability
A vulnerability exists in certain AOS-CX switch models which could allow an attacker with access to the recovery console to bypass normal authentication. A successful exploit allows an attacker to bypass system authentication and achieve total switch compromise in ArubaOS-CX Switches version(s): AOS-CX 10.10.xxxx: 10.10.0002 and below, AOS-CX 10.09.xxxx: 10.09.1030 and below, AOS-CX 10.08.xxxx: 10.08.1070 and below, AOS-CX 10.06.xxxx: 10.06.0210 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address this security vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23691?
CVE-2022-23691 has a critical severity level as it allows an attacker to bypass authentication and gain total control of affected ArubaOS-CX switches.
How do I fix CVE-2022-23691?
To remediate CVE-2022-23691, you should upgrade your ArubaOS-CX to the latest version that addresses this vulnerability.
Which versions of ArubaOS-CX are affected by CVE-2022-23691?
CVE-2022-23691 affects ArubaOS-CX versions from 10.06.0000 to 10.10.0002 inclusive.
What type of attack does CVE-2022-23691 enable?
CVE-2022-23691 enables an attacker to bypass normal authentication via the recovery console and take complete control of the switch.
Is the CVE-2022-23691 vulnerability present in all Aruba switches?
No, CVE-2022-23691 is specific to certain models of ArubaOS-CX switches and does not affect other Aruba switch series.