First published: Wed Mar 01 2023(Updated: )
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.
Credit: security-alert@hpe.com
Affected Software | Affected Version | How to fix |
---|---|---|
Arubanetworks Sd-wan | >=8.7.0.0-2.3.0.0<=8.7.0.0-2.3.0.8 | |
Arubanetworks Arubaos | >=8.6.0.0<=8.6.0.19 | |
Arubanetworks Arubaos | >=8.10.0.0<=8.10.0.4 | |
Arubanetworks Arubaos | >=10.3.0.0<=10.3.1.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID is CVE-2023-22759.
The severity level of CVE-2023-22759 is high.
The affected software for CVE-2023-22759 includes ArubaOS versions 8.7.0.0-2.3.0.0 to 8.7.0.0-2.3.0.8, ArubaOS versions 8.6.0.0 to 8.6.0.19, ArubaOS versions 8.10.0.0 to 8.10.0.4, and ArubaOS versions 10.3.0.0 to 10.3.1.0.
The ArubaOS command injection vulnerabilities can be exploited by an authenticated attacker through the web-based management interface, allowing them to execute arbitrary commands with privileged user access on the underlying operating system.
Yes, Aruba Networks has released a security advisory with patches and mitigations for CVE-2023-22759. Please refer to the official advisory for detailed instructions.