PT-2022-5390 · Aruba Networks · Arubaos+1

Published

2022-10-07

·

Updated

2022-12-13

·

CVE-2022-37885

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Aruba InstantOS versions 6.4.4.8 through 6.4.4.20 and below Aruba InstantOS versions 6.5.4.23 and below Aruba InstantOS versions 8.6.0.18 and below Aruba InstantOS versions 8.7.1.9 and below Aruba InstantOS versions 8.10.0.1 and below ArubaOS versions 10.3.1.0 and below
Description There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Recommendations For Aruba InstantOS versions 6.4.4.8 through 6.4.4.20 and below, upgrade to a newer version that addresses these security vulnerabilities. For Aruba InstantOS versions 6.5.4.23 and below, upgrade to a newer version that addresses these security vulnerabilities. For Aruba InstantOS versions 8.6.0.18 and below, upgrade to a newer version that addresses these security vulnerabilities. For Aruba InstantOS versions 8.7.1.9 and below, upgrade to a newer version that addresses these security vulnerabilities. For Aruba InstantOS versions 8.10.0.1 and below, upgrade to a newer version that addresses these security vulnerabilities. For ArubaOS versions 10.3.1.0 and below, upgrade to a newer version that addresses these security vulnerabilities. As a temporary workaround, consider restricting access to the PAPI UDP port (8211) to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2022-06704
CVE-2022-37885

Affected Products

Aruba Instant
Arubaos