PT-2022-16193 · Aruba · Arubaos-Cx Switches

Published 2022-09-06 · Updated 2022-09-12 · CVE-2022-23683

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ArubaOS-CX Switches versions 10.06.0210 and below ArubaOS-CX Switches versions 10.08.1070 and below ArubaOS-CX Switches versions 10.09.1030 and below ArubaOS-CX Switches versions 10.10.0002 and below

Description Authenticated command injection vulnerabilities exist in the AOS-CX Network Analytics Engine via NAE scripts. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system, leading to a complete compromise of the switch running AOS-CX.

Recommendations For versions 10.06.0210 and below, upgrade to a newer version to address the security vulnerabilities. For versions 10.08.1070 and below, upgrade to a newer version to address the security vulnerabilities. For versions 10.09.1030 and below, upgrade to a newer version to address the security vulnerabilities. For versions 10.10.0002 and below, upgrade to a newer version to address the security vulnerabilities.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-23683

Affected Products

Arubaos-Cx Switches

References · 4

• https://osv.dev/vulnerability/CVE-2022-23683 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23683 · Security Note
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt · Vendor Advisory
• https://t.me/cvenotify/36049 · Telegram Post