PT-2021-7450 · Aruba · Aruba Instant

Published 2021-03-09 · Updated 2022-05-12 · CVE-2020-24636

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Aruba Instant versions 6.5.4.17 and below Aruba Instant versions 8.3.0.13 and below Aruba Instant versions 8.5.0.10 and below Aruba Instant versions 8.6.0.5 and below Aruba Instant versions 8.7.0.0 and below

Description The issue is related to a lack of data sanitization on the management level, allowing a remote attacker to execute arbitrary commands by sending specially crafted data. This can be exploited to gain unauthorized access and control.

Recommendations For Aruba Instant versions 6.5.4.17 and below, update to a version above 6.5.4.17 to address the security vulnerability. For Aruba Instant versions 8.3.0.13 and below, update to a version above 8.3.0.13 to address the security vulnerability. For Aruba Instant versions 8.5.0.10 and below, update to a version above 8.5.0.10 to address the security vulnerability. For Aruba Instant versions 8.6.0.5 and below, update to a version above 8.6.0.5 to address the security vulnerability. For Aruba Instant versions 8.7.0.0 and below, update to a version above 8.7.0.0 to address the security vulnerability.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2022-06348

CVE-2020-24636

Affected Products

Aruba Instant

References · 7

• https://arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24636 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf · Patch
• https://osv.dev/vulnerability/CVE-2020-24636 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06348 · Security Note
• https://t.me/cvenotify/12264 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-21-131-14 · Note