ArubaOS CLI Session Expiration Bypass
CVE-2023-22771 Published on March 1, 2023
Insufficient Session Expiration in ArubaOS Command Line Interface
An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impacted account
Vulnerability Analysis
CVE-2023-22771 can be exploited with network access, requires user interaction and user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Products Associated with CVE-2023-22771
stack.watch emails you whenever new vulnerabilities are published in Aruba Networks Sd Wan or Aruba Networks Arubaos. Just hit a watch button to start following.
Affected Versions
Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central:- Version ArubaOS 8.6.x.x: 8.6.0.19 and below is affected.
- Version ArubaOS 8.10.x.x: 8.10.0.4 and below is affected.
- Version ArubaOS 10.3.x.x: 10.3.1.0 and below is affected.
- Version SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.