Authenticated CMD injection in ArubaOS CLI enables privileged OS exec
CVE-2023-22769 Published on March 1, 2023
Authenticated Remote Command Execution in the ArubaOS Command Line Interface
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Vulnerability Analysis
CVE-2023-22769 can be exploited with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Products Associated with CVE-2023-22769
stack.watch emails you whenever new vulnerabilities are published in Aruba Networks Sd Wan or Aruba Networks Arubaos. Just hit a watch button to start following.
Affected Versions
Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central:- Version ArubaOS 8.6.x.x: 8.6.0.19 and below is affected.
- Version ArubaOS 8.10.x.x: 8.10.0.4 and below is affected.
- Version ArubaOS 10.3.x.x: 10.3.1.0 and below is affected.
- Version SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.