CVE-2023-22759: Command Injection
First published: Wed Mar 01 2023(Updated: )
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.
Credit: security-alert@hpe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Aruba Networks SD-WAN | >=8.7.0.0-2.3.0.0<=8.7.0.0-2.3.0.8 | |
| arubanetworks ArubaOS | >=8.6.0.0<=8.6.0.19 | |
| arubanetworks ArubaOS | >=8.10.0.0<=8.10.0.4 | |
| arubanetworks ArubaOS | >=10.3.0.0<=10.3.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for the ArubaOS command injection vulnerabilities?
The vulnerability ID is CVE-2023-22759.
What is the severity level of CVE-2023-22759?
The severity level of CVE-2023-22759 is high.
What is the affected software for CVE-2023-22759?
The affected software for CVE-2023-22759 includes ArubaOS versions 8.7.0.0-2.3.0.0 to 8.7.0.0-2.3.0.8, ArubaOS versions 8.6.0.0 to 8.6.0.19, ArubaOS versions 8.10.0.0 to 8.10.0.4, and ArubaOS versions 10.3.0.0 to 10.3.1.0.
How can the ArubaOS command injection vulnerabilities be exploited?
The ArubaOS command injection vulnerabilities can be exploited by an authenticated attacker through the web-based management interface, allowing them to execute arbitrary commands with privileged user access on the underlying operating system.
Is there a fix available for CVE-2023-22759?
Yes, Aruba Networks has released a security advisory with patches and mitigations for CVE-2023-22759. Please refer to the official advisory for detailed instructions.
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/arubanetworks
- canonical/aruba networks sd-wan
- version/aruba networks sd-wan/8.7.0.0-2.3.0.0
- version/aruba networks sd-wan/8.7.0.0-2.3.0.8
- canonical/arubanetworks arubaos
- version/arubanetworks arubaos/8.6.0.0
- version/arubanetworks arubaos/8.6.0.19
- version/arubanetworks arubaos/8.10.0.0
- version/arubanetworks arubaos/8.10.0.4
- version/arubanetworks arubaos/10.3.0.0
- version/arubanetworks arubaos/10.3.1.0