CVE-2023-30505: Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface
First published: Tue May 16 2023(Updated: )
Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Credit: security-alert@hpe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Arubanetworks Edgeconnect Enterprise | <=9.0.8.0 | |
| Arubanetworks Edgeconnect Enterprise | >=9.1.0.0<=9.1.5.0 | |
| Arubanetworks Edgeconnect Enterprise | >=9.2.0.0<=9.2.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-30505?
CVE-2023-30505 is a vulnerability in the Aruba EdgeConnect Enterprise command line interface that allows remote authenticated users to run arbitrary commands on the underlying host.
How severe is CVE-2023-30505?
CVE-2023-30505 has a severity rating of 8.8, which is considered high.
Which versions of Aruba EdgeConnect Enterprise are affected by CVE-2023-30505?
Versions up to and including 9.0.8.0, versions between 9.1.0.0 and 9.1.5.0 (inclusive), and versions between 9.2.0.0 and 9.2.3.0 (inclusive) of Aruba EdgeConnect Enterprise are affected by CVE-2023-30505.
How can remote authenticated users exploit CVE-2023-30505?
Remote authenticated users can exploit CVE-2023-30505 to run arbitrary commands as root on the underlying operating system.
Is there a fix available for CVE-2023-30505?
Aruba Networks has provided a security advisory with mitigation steps for CVE-2023-30505. Please refer to the advisory at the following link: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-007.txt
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/title
- agent/author
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/arubanetworks
- canonical/arubanetworks edgeconnect enterprise
- version/arubanetworks edgeconnect enterprise/9.0.8.0
- version/arubanetworks edgeconnect enterprise/9.1.0.0
- version/arubanetworks edgeconnect enterprise/9.1.5.0
- version/arubanetworks edgeconnect enterprise/9.2.0.0
- version/arubanetworks edgeconnect enterprise/9.2.3.0