PT-2024-2048 · Aruba · Arubaos

Aruba Engineering · Published 2024-03-05 · Updated 2024-03-06 · CVE-2024-25616

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ArubaOS (affected versions not specified)

Description The issue is related to certain configurations of ArubaOS that can lead to partial disclosure of sensitive information in the IKE AUTH negotiation process. The scenarios in which disclosure of potentially sensitive information can occur are complex and depend on factors beyond the control of attackers. The vulnerability is associated with shortcomings in the authentication procedure, which can allow a remote attacker to gain unauthorized access to protected information during the IKE AUTH negotiation process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2024-01926

CVE-2024-25616

Affected Products

Arubaos

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-25616 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25616 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01926 · Security Note
• https://twitter.com/CVEnew/status/1765111713819414883 · Twitter Post
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt · Note