PT-2021-18107 · Aruba · Aruba 8320 Switch Series+7

Published 2021-07-22 · Updated 2021-08-06 · CVE-2021-29143

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Aruba CX 6200F Switch Series versions prior to 10.04.3070 Aruba 6300 Switch Series versions prior to 10.04.3070 Aruba 6400 Switch Series versions prior to 10.04.3070 Aruba 8320 Switch Series versions prior to 10.04.3070 Aruba 8325 Switch Series versions prior to 10.04.3070 Aruba 8400 Switch Series versions prior to 10.04.3070 Aruba CX 8360 Switch Series versions prior to 10.04.3070 Aruba AOS-CX firmware versions 10.04.xxxx through 10.04.3069 Aruba AOS-CX firmware versions 10.05.xxxx through 10.05.0069 Aruba AOS-CX firmware versions 10.06.xxxx through 10.06.0109 Aruba AOS-CX firmware versions 10.07.xxxx through 10.07.0000

Description: A remote execution of arbitrary commands vulnerability was discovered in multiple Aruba switch series. The issue allows for the execution of arbitrary commands. Aruba has released upgrades for Aruba AOS-CX devices that address this security vulnerability.

Recommendations: For Aruba CX 6200F Switch Series, update to a version after 10.04.3070. For Aruba 6300 Switch Series, update to a version after 10.04.3070. For Aruba 6400 Switch Series, update to a version after 10.04.3070. For Aruba 8320 Switch Series, update to a version after 10.04.3070. For Aruba 8325 Switch Series, update to a version after 10.04.3070. For Aruba 8400 Switch Series, update to a version after 10.04.3070. For Aruba CX 8360 Switch Series, update to a version after 10.04.3070. For Aruba AOS-CX firmware versions 10.04.xxxx, update to version 10.04.3070 or later. For Aruba AOS-CX firmware versions 10.05.xxxx, update to version 10.05.0070 or later. For Aruba AOS-CX firmware versions 10.06.xxxx, update to version 10.06.0110 or later. For Aruba AOS-CX firmware versions 10.07.xxxx, update to version 10.07.0001 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-29143

Affected Products

Aruba 6300 Switch Series

Aruba 6400 Switch Series

Aruba 8320 Switch Series

Aruba 8325 Switch Series

Aruba 8400 Switch Series

Aruba Aos-Cx

Aruba Cx 6200F Switch Series

Aruba Cx 8360 Switch Series

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-29143 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29143 · Vendor Advisory
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2021-013.txt · Vendor Advisory
• https://t.me/cibsecurity/26386 · Telegram Post