CVE-2023-22766: Authenticated Remote Command Execution in the ArubaOS Command Line Interface

Q: What is CVE-2023-22766?

CVE-2023-22766 is an authenticated command injection vulnerability in the ArubaOS command line interface.

Q: What is the severity of CVE-2023-22766?

CVE-2023-22766 has a severity score of 7.2, indicating a high severity.

Q: How can CVE-2023-22766 be exploited?

CVE-2023-22766 can be exploited by authenticated users to execute arbitrary commands as a privileged user on the underlying operating system.

Q: Which versions of ArubaOS are affected by CVE-2023-22766?

ArubaOS versions from 8.6.0.0 to 8.6.0.19, 8.10.0.0 to 8.10.0.4, and 10.3.0.0 to 10.3.1.0 are affected by CVE-2023-22766.

Q: How can I fix CVE-2023-22766?

To fix CVE-2023-22766, apply the necessary patches and updates provided by Aruba Networks.

Published Feb 28, 2023

Updated

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

Affected Software

51 affected components

Arubanetworks Arubaos>=8.6.0.0<=8.6.0.19

Arubanetworks Arubaos>=8.10.0.0<=8.10.0.4

Arubanetworks Arubaos>=10.3.0.0<=10.3.1.0

Arubanetworks 7010

Arubanetworks 7030

Arubanetworks 7205

Arubanetworks 7210

Arubanetworks 7220

Arubanetworks 7240xm

Arubanetworks 7280

Arubanetworks 9004

Arubanetworks 9004-lte

Arubanetworks 9012

Arubanetworks Mc-va-10

Arubanetworks Mc-va-1k

Arubanetworks Mc-va-250

Arubanetworks Mc-va-50

Arubanetworks Mcr-hw-10k

Arubanetworks Mcr-hw-1k

Arubanetworks Mcr-hw-5k

Arubanetworks Mcr-va-10k

Arubanetworks Mcr-va-1k

Arubanetworks Mcr-va-50

Arubanetworks Mcr-va-500

Arubanetworks Mcr-va-5k

Arubanetworks Sd-wan>=8.7.0.0-2.3.0.0<=8.7.0.0-2.3.0.8

All of the following

Any of the following