Lucene search

[email protected]CVE-2022-23677

HistoryMay 10, 2022 - 7:15 p.m.

CVE-2022-23677

2022-05-1019:15:09

CWE-787

[email protected]

web.nvd.nist.gov

cve-2022-23677

arubaos-switch

remote execution

code vulnerability

security

nvd

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.7%

JSON

A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch 16.03.xxxx: All versions; ArubaOS-Switch 16.04.xxxx: All versions; ArubaOS-Switch 16.05.xxxx: All versions; ArubaOS-Switch 16.06.xxxx: All versions; ArubaOS-Switch 16.07.xxxx: All versions; ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0024 and below; ArubaOS-Switch 16.09.xxxx: KB/WB/WC/YA/YB/YC.16.09.0019 and below; ArubaOS-Switch 16.10.xxxx: KB/WB/WC/YA/YB/YC.16.10.0019 and below; ArubaOS-Switch 16.11.xxxx: KB/WB/WC/YA/YB/YC.16.11.0003 and below. Aruba has released upgrades for ArubaOS-Switch Devices that address these security vulnerabilities.

Affected configurations

NVD

Node

arubanetworks5406r_firmwareRange15.00.0–15.16.0023

arubanetworks5406r_firmwareRange16.01.0–16.02.0034

arubanetworks5406r_firmwareRange16.03.0–16.04.0024

arubanetworks5406r_firmwareRange16.05.0–16.08.0025

arubanetworks5406r_firmwareRange16.09.0–16.09.0020

arubanetworks5406r_firmwareRange16.10.0–16.10.0020

arubanetworks5406r_firmwareRange16.11.0–16.11.0004

AND

arubanetworks5406rMatch-

Node

arubanetworks2920_firmwareRange15.00.0–15.16.0023

arubanetworks2920_firmwareRange16.01.0–16.02.0034

arubanetworks2920_firmwareRange16.03.0–16.04.0024

arubanetworks2920_firmwareRange16.05.0–16.08.0025

arubanetworks2920_firmwareRange16.09.0–16.09.0020

arubanetworks2920_firmwareRange16.10.0–16.10.0020

arubanetworks2920_firmwareRange16.11.0–16.11.0004

AND

arubanetworks2920Match-

Node

arubanetworks2930f_firmwareRange15.00.0–15.16.0023

arubanetworks2930f_firmwareRange16.01.0–16.02.0034

arubanetworks2930f_firmwareRange16.03.0–16.04.0024

arubanetworks2930f_firmwareRange16.05.0–16.08.0025

arubanetworks2930f_firmwareRange16.09.0–16.09.0020

arubanetworks2930f_firmwareRange16.10.0–16.10.0020

arubanetworks2930f_firmwareRange16.11.0–16.11.0004

AND

arubanetworks2930fMatch-

Node

arubanetworks2930m_firmwareRange15.00.0–15.16.0023

arubanetworks2930m_firmwareRange16.01.0–16.02.0034

arubanetworks2930m_firmwareRange16.03.0–16.04.0024

arubanetworks2930m_firmwareRange16.05.0–16.08.0025

arubanetworks2930m_firmwareRange16.09.0–16.09.0020

arubanetworks2930m_firmwareRange16.10.0–16.10.0020

arubanetworks2930m_firmwareRange16.11.0–16.11.0004

AND

arubanetworks2930mMatch-

Node

arubanetworks2530_firmwareRange15.00.0–15.16.0023

arubanetworks2530_firmwareRange16.01.0–16.02.0034

arubanetworks2530_firmwareRange16.03.0–16.04.0024

arubanetworks2530_firmwareRange16.05.0–16.08.0025

arubanetworks2530_firmwareRange16.09.0–16.09.0020

arubanetworks2530_firmwareRange16.10.0–16.10.0020

arubanetworks2530_firmwareRange16.11.0–16.11.0004

AND

arubanetworks2530Match-

Node

arubanetworks2540_firmwareRange15.00.0–15.16.0023

arubanetworks2540_firmwareRange16.01.0–16.02.0034

arubanetworks2540_firmwareRange16.03.0–16.04.0024

arubanetworks2540_firmwareRange16.05.0–16.08.0025

arubanetworks2540_firmwareRange16.09.0–16.09.0020

arubanetworks2540_firmwareRange16.10.0–16.10.0020

arubanetworks2540_firmwareRange16.11.0–16.11.0004

AND

arubanetworks2540Match-

Node

arubanetworks5412r_firmwareRange15.00.0–15.16.0023

arubanetworks5412r_firmwareRange16.01.0–16.02.0034

arubanetworks5412r_firmwareRange16.03.0–16.04.0024

arubanetworks5412r_firmwareRange16.05.0–16.08.0025

arubanetworks5412r_firmwareRange16.09.0–16.09.0020

arubanetworks5412r_firmwareRange16.10.0–16.10.0020

arubanetworks5412r_firmwareRange16.11.0–16.11.0004

AND

arubanetworks5412rMatch-

Node

arubanetworks2615_firmwareRange15.00.0–15.16.0023

arubanetworks2615_firmwareRange16.01.0–16.02.0034

arubanetworks2615_firmwareRange16.03.0–16.04.0024

arubanetworks2615_firmwareRange16.05.0–16.08.0025

arubanetworks2615_firmwareRange16.09.0–16.09.0020

arubanetworks2615_firmwareRange16.10.0–16.10.0020

arubanetworks2615_firmwareRange16.11.0–16.11.0004

AND

arubanetworks2615Match-

Node

arubanetworks2620_firmwareRange15.00.0–15.16.0023

arubanetworks2620_firmwareRange16.01.0–16.02.0034

arubanetworks2620_firmwareRange16.03.0–16.04.0024

arubanetworks2620_firmwareRange16.05.0–16.08.0025

arubanetworks2620_firmwareRange16.09.0–16.09.0020

arubanetworks2620_firmwareRange16.10.0–16.10.0020

arubanetworks2620_firmwareRange16.11.0–16.11.0004

AND

arubanetworks2620Match-

Node

arubanetworks2915_firmwareRange15.00.0–15.16.0023

arubanetworks2915_firmwareRange16.01.0–16.02.0034

arubanetworks2915_firmwareRange16.03.0–16.04.0024

arubanetworks2915_firmwareRange16.05.0–16.08.0025

arubanetworks2915_firmwareRange16.09.0–16.09.0020

arubanetworks2915_firmwareRange16.10.0–16.10.0020

arubanetworks2915_firmwareRange16.11.0–16.11.0004

AND

arubanetworks2915Match-

Node

arubanetworks3810m_firmwareRange15.00.0–15.16.0023

arubanetworks3810m_firmwareRange16.01.0–16.02.0034

arubanetworks3810m_firmwareRange16.03.0–16.04.0024

arubanetworks3810m_firmwareRange16.05.0–16.08.0025

arubanetworks3810m_firmwareRange16.09.0–16.09.0020

arubanetworks3810m_firmwareRange16.10.0–16.10.0020

arubanetworks3810m_firmwareRange16.11.0–16.11.0004

AND

arubanetworks3810mMatch-

CPENameOperatorVersion
arubanetworks:5406r_firmwarearubanetworks 5406r firmwarele15.16.0023
arubanetworks:5406r_firmwarearubanetworks 5406r firmwarelt16.02.0034
arubanetworks:5406r_firmwarearubanetworks 5406r firmwarelt16.04.0024
arubanetworks:5406r_firmwarearubanetworks 5406r firmwarelt16.08.0025
arubanetworks:5406r_firmwarearubanetworks 5406r firmwarelt16.09.0020
arubanetworks:5406r_firmwarearubanetworks 5406r firmwarelt16.10.0020
arubanetworks:5406r_firmwarearubanetworks 5406r firmwarelt16.11.0004

CPE	Name	Operator	Version
arubanetworks:5406r_firmware	arubanetworks 5406r firmware	le	15.16.0023
arubanetworks:5406r_firmware	arubanetworks 5406r firmware	lt	16.02.0034
arubanetworks:5406r_firmware	arubanetworks 5406r firmware	lt	16.04.0024
arubanetworks:5406r_firmware	arubanetworks 5406r firmware	lt	16.08.0025
arubanetworks:5406r_firmware	arubanetworks 5406r firmware	lt	16.09.0020
arubanetworks:5406r_firmware	arubanetworks 5406r firmware	lt	16.10.0020
arubanetworks:5406r_firmware	arubanetworks 5406r firmware	lt	16.11.0004

CNA Affected

[
  {
    "product": "ArubaOS-Switch Devices",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "ArubaOS-Switch 15.xx.xxxx: All versions"
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.01.xxxx: All versions"
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below"
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.03.xxxx: All versions"
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.04.xxxx: All versions"
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.05.xxxx: All versions"
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.06.xxxx: All versions"
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.07.xxxx: All versions"
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0024 and below"
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.09.xxxx: KB/WB/WC/YA/YB/YC.16.09.0019 and below"
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.10.xxxx: KB/WB/WC/YA/YB/YC.16.10.0019 and below"
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.11.xxxx: KB/WB/WC/YA/YB/YC.16.11.0003 and below."
      }
    ]
  }
]

References

www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-008.txt

Social References

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.7%

JSON

Related for CVE-2022-23677

nvd1 cvelist1 checkpoint_advisories1 prion1 thn1