CVE-2023-22759: Authenticated Remote Command Execution in ArubaOS Web-based Management Interface
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for the ArubaOS command injection vulnerabilities?
The vulnerability ID is CVE-2023-22759.
What is the severity level of CVE-2023-22759?
The severity level of CVE-2023-22759 is high.
What is the affected software for CVE-2023-22759?
The affected software for CVE-2023-22759 includes ArubaOS versions 8.7.0.0-2.3.0.0 to 8.7.0.0-2.3.0.8, ArubaOS versions 8.6.0.0 to 8.6.0.19, ArubaOS versions 8.10.0.0 to 8.10.0.4, and ArubaOS versions 10.3.0.0 to 10.3.1.0.
How can the ArubaOS command injection vulnerabilities be exploited?
The ArubaOS command injection vulnerabilities can be exploited by an authenticated attacker through the web-based management interface, allowing them to execute arbitrary commands with privileged user access on the underlying operating system.
Is there a fix available for CVE-2023-22759?
Yes, Aruba Networks has released a security advisory with patches and mitigations for CVE-2023-22759. Please refer to the official advisory for detailed instructions.