CVE-2023-22776: Authenticated Remote Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Read

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2023-22776.

Q: What is the severity of CVE-2023-22776?

CVE-2023-22776 has a severity value of 4.9, which is classified as medium.

Q: What is the affected software for CVE-2023-22776?

The affected software for CVE-2023-22776 includes ArubaOS versions between 8.6.0.0 to 8.6.0.19, 8.10.0.0 to 8.10.0.4, and 10.3.0.0 to 10.3.1.0.

Q: How does CVE-2023-22776 impact the system?

Successful exploitation of CVE-2023-22776 allows an authenticated attacker to read arbitrary files on the underlying operating system, including sensitive system files.

Q: Is the Arubanetworks 7010 vulnerable to CVE-2023-22776?

No, the Arubanetworks 7010 is not vulnerable to CVE-2023-22776.

Published Feb 28, 2023

Updated

An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files.

Affected Software

51 affected components

All of the following

Any of the following

Arubanetworks Arubaos>=8.6.0.0<=8.6.0.19

Arubanetworks Arubaos>=8.10.0.0<=8.10.0.4

Arubanetworks Arubaos>=10.3.0.0<=10.3.1.0

Any of the following

Arubanetworks 7010

Arubanetworks 7030

Arubanetworks 7205

Arubanetworks 7210

Arubanetworks 7220

Arubanetworks 7240xm

Arubanetworks 7280

Arubanetworks 9004

Arubanetworks 9004-lte

Arubanetworks 9012

Arubanetworks Mc-va-10

Arubanetworks Mc-va-1k

Arubanetworks Mc-va-250

Arubanetworks Mc-va-50

Arubanetworks Mcr-hw-10k

Arubanetworks Mcr-hw-1k

Arubanetworks Mcr-hw-5k

Arubanetworks Mcr-va-10k

Arubanetworks Mcr-va-1k

Arubanetworks Mcr-va-50

Arubanetworks Mcr-va-500

Arubanetworks Mcr-va-5k

Arubanetworks Sd-wan>=8.7.0.0-2.3.0.0<=8.7.0.0-2.3.0.8