CVE-2023-38485: Multiple Buffer Overflow Vulnerabilities in BIOS Implementation of 9200 and 9000 Series Controllers and Gateways
First published: Wed Sep 06 2023(Updated: )
Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code early in the boot sequence. An attacker could exploit this vulnerability to gain access to and change underlying sensitive information in the affected controller leading to complete system compromise.
Credit: security-alert@hpe.com security-alert@hpe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Arubanetworks Arubaos | >=8.6.0.0<8.6.0.22 | |
| Arubanetworks Arubaos | >=8.10.0.0<8.10.0.7 | |
| Arubanetworks Arubaos | >=8.11.0.0<8.11.1.1 | |
| Arubanetworks Arubaos | >=10.4.0.0<10.4.0.2 | |
| Arubanetworks 9004 | ||
| Arubanetworks 9004-lte | ||
| Arubanetworks 9012 | ||
| Arubanetworks 9240 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID of this BIOS vulnerability?
The vulnerability ID of this BIOS vulnerability is CVE-2023-38485.
What is the severity of CVE-2023-38485?
The severity of CVE-2023-38485 is high.
Which software versions are affected by CVE-2023-38485?
The affected software versions are ArubaOS between 8.6.0.0 and 8.6.0.22, ArubaOS between 8.10.0.0 and 8.10.0.7, ArubaOS between 8.11.0.0 and 8.11.1.1, and ArubaOS between 10.4.0.0 and 10.4.0.2.
How can an attacker exploit CVE-2023-38485?
An attacker can exploit CVE-2023-38485 to execute arbitrary code early in the boot sequence of Aruba 9200 and 9000 Series Controllers and Gateways.
Is Arubanetworks 9004 and 9004-lte vulnerable to CVE-2023-38485?
No, Arubanetworks 9004 and 9004-lte are not vulnerable to CVE-2023-38485.
- collector/nvd-api
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/severity
- agent/title
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/arubanetworks
- canonical/arubanetworks arubaos
- version/arubanetworks arubaos/8.6.0.0
- version/arubanetworks arubaos/8.10.0.0
- version/arubanetworks arubaos/8.11.0.0
- version/arubanetworks arubaos/10.4.0.0
- canonical/arubanetworks 9004
- canonical/arubanetworks 9004-lte
- canonical/arubanetworks 9012
- canonical/arubanetworks 9240