PT-2022-24142 · Aruba · Arubaos

Published 2022-11-03 · Updated 2022-12-14 · CVE-2022-37908

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ArubaOS versions on 7xxx series controllers (affected versions not specified)

Description An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2022-37908

Affected Products

Arubaos

References · 5

• https://osv.dev/vulnerability/CVE-2022-37908 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37908 · Security Note
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt · Vendor Advisory
• https://t.me/cvenotify/39842 · Telegram Post
• https://t.me/cibsecurity/54281 · Telegram Post