PT-2021-9118 · Aruba · Aruba Instant

Published 2021-03-29 · Updated 2022-07-22 · CVE-2019-5317

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aruba Instant versions 6.4.x: 6.4.4.8 through 4.2.4.18 and below Aruba Instant versions 6.5.x: 6.5.4.15 and below Aruba Instant versions 8.3.x: 8.3.0.11 and below Aruba Instant versions 8.4.x: 8.4.0.5 and below Aruba Instant versions 8.5.x: 8.5.0.6 and below Aruba Instant versions 8.6.x: 8.6.0.2 and below

Description A local authentication bypass issue was discovered in some Aruba Instant Access Point products. This issue allows for a bypass of local authentication. Aruba has released patches to address this security issue.

Recommendations For Aruba Instant 6.4.x versions 6.4.4.8 through 4.2.4.18 and below, update to a version above 4.2.4.18. For Aruba Instant 6.5.x versions 6.5.4.15 and below, update to a version above 6.5.4.15. For Aruba Instant 8.3.x versions 8.3.0.11 and below, update to a version above 8.3.0.11. For Aruba Instant 8.4.x versions 8.4.0.5 and below, update to a version above 8.4.0.5. For Aruba Instant 8.5.x versions 8.5.0.6 and below, update to a version above 8.5.0.6. For Aruba Instant 8.6.x versions 8.6.0.2 and below, update to a version above 8.6.0.2.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-5317

Affected Products

Aruba Instant

References · 5

• https://arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-5317 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5317 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf · Patch
• https://t.me/cvenotify/33605 · Telegram Post