PT-2021-21839 · Aruba · Aruba Operating System

Published 2021-09-07 · Updated 2022-02-11 · CVE-2021-37724

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Aruba Operating System Software versions prior to 8.7.1.2 Aruba Operating System Software version 8.6.0.8 Aruba Operating System Software version 8.5.0.12 Aruba Operating System Software version 8.3.0.16

Description: A remote arbitrary command execution issue was discovered in Aruba Operating System Software. This allows for the execution of commands by remote attackers. Aruba has released patches for ArubaOS to address this issue.

Recommendations: For versions prior to 8.7.1.2, update to version 8.7.1.2 or later to resolve the issue. For version 8.6.0.8, update to a version later than 8.6.0.8 to resolve the issue. For version 8.5.0.12, update to a version later than 8.5.0.12 to resolve the issue. For version 8.3.0.16, update to a version later than 8.3.0.16 to resolve the issue.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-37724

Affected Products

Aruba Operating System

References · 5

• https://osv.dev/vulnerability/CVE-2021-37724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37724 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdf · Vendor Advisory
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt · Vendor Advisory
• https://t.me/cibsecurity/28333 · Telegram Post