CVE-2023-22767: Authenticated Remote Command Execution in the ArubaOS Command Line Interface

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2023-22767.

Q: What is the severity of CVE-2023-22767?

The severity of CVE-2023-22767 is high with a score of 7.2.

Q: What is the affected software for CVE-2023-22767?

The affected software for CVE-2023-22767 is ArubaOS versions 8.6.0.0 to 8.6.0.19, 8.10.0.0 to 8.10.0.4, and 10.3.0.0 to 10.3.1.0.

Q: How does CVE-2023-22767 impact the system?

CVE-2023-22767 allows authenticated users to execute arbitrary commands as a privileged user on the underlying operating system.

Q: Is there a fix available for CVE-2023-22767?

Yes, please refer to the advisory from Aruba Networks for instructions on how to mitigate or resolve the vulnerability.

Published Feb 28, 2023

Updated

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

Affected Software

51 affected components

Arubanetworks Arubaos>=8.6.0.0<=8.6.0.19

Arubanetworks Arubaos>=8.10.0.0<=8.10.0.4

Arubanetworks Arubaos>=10.3.0.0<=10.3.1.0

Arubanetworks 7010

Arubanetworks 7030

Arubanetworks 7205

Arubanetworks 7210

Arubanetworks 7220

Arubanetworks 7240xm

Arubanetworks 7280

Arubanetworks 9004

Arubanetworks 9004-lte

Arubanetworks 9012

Arubanetworks Mc-va-10

Arubanetworks Mc-va-1k

Arubanetworks Mc-va-250

Arubanetworks Mc-va-50

Arubanetworks Mcr-hw-10k

Arubanetworks Mcr-hw-1k

Arubanetworks Mcr-hw-5k

Arubanetworks Mcr-va-10k

Arubanetworks Mcr-va-1k

Arubanetworks Mcr-va-50

Arubanetworks Mcr-va-500

Arubanetworks Mcr-va-5k

Arubanetworks Sd-wan>=8.7.0.0-2.3.0.0<=8.7.0.0-2.3.0.8

All of the following

Any of the following