CVE-2022-37897: OS Command Injection
There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-37897?
CVE-2022-37897 refers to a command injection vulnerability in Arubanetworks SD-WAN and ArubaOS.
What is the severity of CVE-2022-37897?
The severity of CVE-2022-37897 is critical with a CVSS score of 9.8.
How can CVE-2022-37897 be exploited?
CVE-2022-37897 can be exploited by sending specially crafted packets to the PAPI UDP port (8211) of Arubanetworks SD-WAN and ArubaOS.
Which versions of Arubanetworks SD-WAN are affected by CVE-2022-37897?
Versions 8.7.0.0-2.3.0.0 to 8.7.0.0-2.3.0.6 of Arubanetworks SD-WAN are affected by CVE-2022-37897.
Which versions of ArubaOS are affected by CVE-2022-37897?
Versions 6.5.4.0 to 6.5.4.22, 8.4.0.0 to 8.6.0.17, 8.7.0.0 to 8.7.1.9, and 8.8.0.0 to 10.3.0.1 of ArubaOS are affected by CVE-2022-37897.