CVE-2023-38485: Multiple Buffer Overflow Vulnerabilities in BIOS Implementation of 9200 and 9000 Series Controllers and Gateways
Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code early in the boot sequence. An attacker could exploit this vulnerability to gain access to and change underlying sensitive information in the affected controller leading to complete system compromise.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this BIOS vulnerability?
The vulnerability ID of this BIOS vulnerability is CVE-2023-38485.
What is the severity of CVE-2023-38485?
The severity of CVE-2023-38485 is high.
Which software versions are affected by CVE-2023-38485?
The affected software versions are ArubaOS between 8.6.0.0 and 8.6.0.22, ArubaOS between 8.10.0.0 and 8.10.0.7, ArubaOS between 8.11.0.0 and 8.11.1.1, and ArubaOS between 10.4.0.0 and 10.4.0.2.
How can an attacker exploit CVE-2023-38485?
An attacker can exploit CVE-2023-38485 to execute arbitrary code early in the boot sequence of Aruba 9200 and 9000 Series Controllers and Gateways.
Is Arubanetworks 9004 and 9004-lte vulnerable to CVE-2023-38485?
No, Arubanetworks 9004 and 9004-lte are not vulnerable to CVE-2023-38485.