PT-2021-21836 · Aruba · Aruba Operating System+1

Published

2021-09-07

·

Updated

2022-04-22

·

CVE-2021-37721

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: Aruba SD-WAN Software and Gateways versions prior to 8.6.0.4-2.2.0.4 Aruba Operating System Software versions prior to 8.7.1.4 Aruba Operating System Software versions prior to 8.6.0.9 Aruba Operating System Software versions prior to 8.5.0.13 Aruba Operating System Software versions prior to 8.3.0.16 Aruba Operating System Software version 6.5.4.20 Aruba Operating System Software version 6.4.4.25
Description: A remote arbitrary command execution issue was discovered in Aruba SD-WAN Software and Gateways. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security issue.
Recommendations: For Aruba SD-WAN Software and Gateways version prior to 8.6.0.4-2.2.0.4, update to a patched version. For Aruba Operating System Software version prior to 8.7.1.4, update to version 8.7.1.4 or later. For Aruba Operating System Software version prior to 8.6.0.9, update to version 8.6.0.9 or later. For Aruba Operating System Software version prior to 8.5.0.13, update to version 8.5.0.13 or later. For Aruba Operating System Software version prior to 8.3.0.16, update to version 8.3.0.16 or later. For Aruba Operating System Software version 6.5.4.20, update to a later version. For Aruba Operating System Software version 6.4.4.25, update to a later version.

Fix

Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-37721

Affected Products

Aruba Operating System
Aruba Sd-Wan Software/Gateways