PT-2022-24127 · Aruba · Arubaos 10+1

Published 2022-10-07 · Updated 2023-08-08 · CVE-2022-37893

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aruba InstantOS versions 6.4.4.8 through 4.2.4.20 and below Aruba InstantOS versions 6.5.4.23 and below Aruba InstantOS versions 8.6.0.18 and below Aruba InstantOS versions 8.7.1.9 and below Aruba InstantOS versions 8.10.0.1 and below ArubaOS 10 versions 10.3.1.0 and below

Description An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.

Recommendations For Aruba InstantOS versions 6.4.4.8 through 4.2.4.20 and below, upgrade to a version above 4.2.4.20. For Aruba InstantOS versions 6.5.4.23 and below, upgrade to a version above 6.5.4.23. For Aruba InstantOS versions 8.6.0.18 and below, upgrade to a version above 8.6.0.18. For Aruba InstantOS versions 8.7.1.9 and below, upgrade to a version above 8.7.1.9. For Aruba InstantOS versions 8.10.0.1 and below, upgrade to a version above 8.10.0.1. For ArubaOS 10 versions 10.3.1.0 and below, upgrade to a version above 10.3.1.0.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-37893

Affected Products

Aruba Instant

Arubaos 10

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-37893 · Security Note
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-37893 · Vendor Advisory
• https://t.me/cvenotify/37354 · Telegram Post
• https://t.me/cvenotify/37277 · Telegram Post
• https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf · Note
• https://t.me/cibsecurity/51010 · Telegram Post