PT-2018-17881 · Aruba · Aruba Clearpass Policy Manager

Published 2018-12-07 · Updated 2019-10-03 · CVE-2018-7066

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aruba ClearPass Policy Manager versions prior to 6.7.5 Aruba ClearPass Policy Manager versions prior to 6.6.10-hotfix

Description An unauthenticated remote command execution issue exists in the ClearPass OnConnect feature, which allows administrators to link other network devices into ClearPass. A defect in the API could allow a remote attacker to execute arbitrary commands on one of the linked devices. This issue is only applicable if credentials for devices have been supplied to ClearPass under Configuration -> Network -> Devices -> CLI Settings.

Recommendations For versions prior to 6.7.5, update to version 6.7.5 to resolve the issue. For versions prior to 6.6.10-hotfix, apply the 6.6.10-hotfix to resolve the issue. As a temporary workaround, consider restricting access to the linked devices or removing device credentials from ClearPass to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2018-7066

Affected Products

Aruba Clearpass Policy Manager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-7066 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7066 · Vendor Advisory
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2018-007.txt · Vendor Advisory