Lucene search

[email protected]CVE-2023-39268

HistoryAug 29, 2023 - 8:15 p.m.

CVE-2023-39268

2023-08-2920:15:09

CWE-787

[email protected]

web.nvd.nist.gov

arubaos

switch

cve-2023-39268

memory corruption

remote code execution

vulnerability

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.4%

JSON

A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

Affected configurations

NVD

Node

hpearubaos-switchRange<a.15.16.0026

hpearubaos-switchRange16.01.0000–16.04.0027

hpearubaos-switchRange16.05.0000–16.08.0027

hpearubaos-switchRange16.10.0001–16.10.0024

hpearubaos-switchRange16.11.0001–16.11.0013

AND

arubanetworksaruba_2530Match-

arubanetworksaruba_2530yaMatch-

arubanetworksaruba_2530ybMatch-

arubanetworksaruba_2540Match-

arubanetworksaruba_2920Match-

arubanetworksaruba_2930fMatch-

arubanetworksaruba_2930mMatch-

arubanetworksaruba_3810mMatch-

arubanetworksaruba_5406r_zl2Match-

arubanetworksaruba_5412r_zl2Match-

CPENameOperatorVersion
hpe:arubaos-switchhpe arubaos-switchlta.15.16.0026
hpe:arubaos-switchhpe arubaos-switchlt16.04.0027
hpe:arubaos-switchhpe arubaos-switchlt16.08.0027
hpe:arubaos-switchhpe arubaos-switchlt16.10.0024
hpe:arubaos-switchhpe arubaos-switchlt16.11.0013

CPE	Name	Operator	Version
hpe:arubaos-switch	hpe arubaos-switch	lt	a.15.16.0026
hpe:arubaos-switch	hpe arubaos-switch	lt	16.04.0027
hpe:arubaos-switch	hpe arubaos-switch	lt	16.08.0027
hpe:arubaos-switch	hpe arubaos-switch	lt	16.10.0024
hpe:arubaos-switch	hpe arubaos-switch	lt	16.11.0013

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "ArubaOS-Switch",
    "vendor": "Hewlett Packard Enterprise",
    "versions": [
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.11.xxxx: KB/WC/YA/YB/YC.16.11.0012 and below."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.10.xxxx: KB/WC/YA/YB/YC.16.10.0025 and below."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.10.xxxx: WB.16.10.23 and below."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.09.xxxx: All versions."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0026 and below."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.07.xxxx: All versions."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.06.xxxx: All versions."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.05.xxxx: All versions."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.04.xxxx: KA/RA.16.04.0026 and below."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.03.xxxx: All versions."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.02.xxxx: All versions."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.01.xxxx: All versions."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 15.xx.xxxx: 15.16.0025 and below."
      }
    ]
  }
]

References

www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-013.txt

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.4%

JSON

Related for CVE-2023-39268

nvd1 cvelist1 prion1