PT-2022-5794 · Aruba · Aruba Edgeconnect Enterprise Orchestrator

Published 2022-10-11 · Updated 2022-11-01 · CVE-2022-37915

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Aruba EdgeConnect Enterprise Orchestrator versions 9.1.x prior to 9.1.3.40197

Description A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system, leading to a complete system compromise of Aruba EdgeConnect Enterprise Orchestration. The issue is related to inadequate access control in the web-based management interface.

Recommendations For Aruba EdgeConnect Enterprise Orchestrator versions 9.1.x prior to 9.1.3.40197, update to version 9.1.3.40197 or later to resolve the issue. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.

Fix

Improper Privilege Management

OS Command Injection

Weakness Enumeration

CWE-269

CWE-264

CWE-78

Related Identifiers

BDU:2022-07194

CVE-2022-37915

Affected Products

Aruba Edgeconnect Enterprise Orchestrator

References · 8

• https://osv.dev/vulnerability/CVE-2022-37915 · Vendor Advisory
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2022-015.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37915 · Security Note
• https://bdu.fstec.ru/vul/2022-07194 · Security Note
• https://t.me/echeloneyes/772 · Telegram Post
• https://t.me/true_secator/3560 · Telegram Post
• https://t.me/cibsecurity/52196 · Telegram Post
• https://bleepingcomputer.com/news/security/aruba-fixes-critical-rce-and-auth-bypass-flaws-in-edgeconnect · Note