Nicholas Starke

**Name of the Vulnerable Software and Affected Versions** AOS Instant versions 8.x.x.x **Description** A flaw in the XML handling component of AOS-8 DHCP services allows an unauthenticated remote attacker to trigger a denial-of-service condition. This occurs through excessive resource consumption upon user interaction, which can lead to service disruption or reduced system availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Orchestrator (affected versions not specified) **Description** A flaw exists in the Orchestrator service that may allow a remote attacker who does not have an account to circumvent multi-factor authentication. Exploitation of this issue could lead to the creation of an administrator-level user account without the required multi-factor authentication, potentially compromising secure access to the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ArubaOS-CX (affected versions not specified) **Description** A platform-level denial-of-service (DoS) issue exists in the software. Successful exploitation could allow an attacker with administrative access to execute code that renders the switch non-bootable and non-functional. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** (affected versions not specified) **Description** A flaw exists in the command line interface that may allow a remote attacker with authentication to inject commands. Exploitation could lead to the execution of arbitrary commands on the operating system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Affected versions not specified **Description** A flaw exists in the web-based management interface that may allow a remote attacker to cause a denial of service. Exploitation could lead to a system crash, requiring manual reboot and potentially disrupting network operations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AOS firmware (affected versions not specified) **Description** A flaw exists in an AOS firmware binary that could allow a malicious, authenticated actor to permanently delete critical boot information. Exploitation of this issue can cause the system to become unbootable, leading to a Denial of Service. Recovery from this condition requires hardware replacement. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aruba Access Points (affected versions not specified) **Description** A security flaw allows an attacker to bypass the hardware root of trust verification, enabling the execution of modified or custom firmware on affected devices. This bypass impacts the integrity of the boot process, potentially leading to complete system compromise. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AOS-8 Instant (affected versions not specified) AOS 10 (affected versions not specified) **Description** A flaw exists in how ethernet frames are processed, potentially allowing a remote attacker to cause a denial of service. Successful exploitation may disrupt network services and require manual intervention to restore functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Aruba Networking 501 Wireless Client Bridge (affected versions not specified) **Description** The issue is related to command injection vulnerabilities in the web interface of the HPE Aruba Networking 501 Wireless Client Bridge. These vulnerabilities could allow a remote attacker to execute arbitrary commands as a privileged user on the underlying operating system. The exploitation requires administrative authentication credentials on the host system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions mentioned. **Description** An authenticated issue has been identified that allows an attacker to establish highly privileged persistent arbitrary code execution across boot cycles. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Aruba 9200 and 9000 Series Controllers and Gateways (affected versions not specified) **Description** Vulnerabilities exist in the BIOS implementation that could allow an attacker to execute arbitrary code early in the boot sequence. An attacker could exploit this vulnerability to gain access to and change underlying sensitive information in the affected controller, leading to complete system compromise. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aruba 9200 and 9000 Series Controllers and Gateways (affected versions not specified) **Description** Vulnerabilities exist in the BIOS implementation that could allow an attacker to execute arbitrary code early in the boot sequence. An attacker could exploit this issue to gain access to and change underlying sensitive information in the affected controller, leading to complete system compromise. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aruba 9200 and 9000 Series Controllers and Gateways (affected versions not specified) **Description** A vulnerability in the secure boot implementation allows an attacker to bypass security controls, which would normally prohibit unsigned kernel images from executing. This enables the attacker to execute arbitrary runtime operating systems, including unverified and unsigned OS images. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ArubaOS (affected versions not specified) **Description** An authenticated path traversal issue exists in the ArubaOS command line interface, allowing successful exploitation to result in the ability to read arbitrary files on the underlying operating system, including sensitive system files. This can enable unauthorized access to protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pfSense versions prior to 2.2.3 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `descr` parameter in a "new" action to "system authservers.php" API endpoint. **Recommendations** For versions prior to 2.2.3, update to version 2.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "system authservers.php" endpoint to minimize the risk of exploitation. Avoid using the `descr` parameter in the affected endpoint until the issue is resolved.