PT-2021-21838 · Aruba · Aruba Operating System

Published 2021-09-07 · Updated 2022-02-11 · CVE-2021-37723

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Aruba Operating System Software versions prior to 8.7.1.2 Aruba Operating System Software version 8.6.0.8 Aruba Operating System Software version 8.5.0.12 Aruba Operating System Software version 8.3.0.16

Description: A remote arbitrary command execution issue was discovered in Aruba Operating System Software. This allows for the execution of commands by remote attackers. Aruba has released patches for ArubaOS to address this issue.

Recommendations: For versions prior to 8.7.1.2, update to version 8.7.1.2 or later. For version 8.6.0.8, update to a version later than 8.6.0.8. For version 8.5.0.12, update to a version later than 8.5.0.12. For version 8.3.0.16, update to a version later than 8.3.0.16.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-37723

Affected Products

Aruba Operating System

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-37723 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37723 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf · Vendor Advisory
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt · Vendor Advisory
• https://t.me/cibsecurity/28331 · Telegram Post