PT-2022-16201 · Aruba · Arubaos-Cx Switches

Published 2022-09-06 · Updated 2023-08-08 · CVE-2022-23690

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ArubaOS-CX Switches versions 10.10.0002 and below ArubaOS-CX Switches versions 10.09.1020 and below ArubaOS-CX Switches versions 10.08.1060 and below ArubaOS-CX Switches versions 10.06.0200 and below

Description A vulnerability in the web-based management interface of AOS-CX could allow a remote unauthenticated attacker to fingerprint the exact version AOS-CX running on the switch. This allows an attacker to retrieve information which could be used to more precisely target the switch for further exploitation.

Recommendations For versions 10.10.xxxx, upgrade to a version above 10.10.0002. For versions 10.09.xxxx, upgrade to a version above 10.09.1020. For versions 10.08.xxxx, upgrade to a version above 10.08.1060. For versions 10.06.xxxx, upgrade to a version above 10.06.0200.

Fix

Related Identifiers

CVE-2022-23690

Affected Products

Arubaos-Cx Switches

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-23690 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23690 · Vendor Advisory
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt · Vendor Advisory
• https://t.me/cvenotify/36038 · Telegram Post