Lucene search

HpeCVELIST:CVE-2023-39268

HistoryAug 29, 2023 - 7:38 p.m.

CVE-2023-39268 Memory Corruption Vulnerability in ArubaOS-Switch

2023-08-2919:38:58

hpe

www.cve.org

arubaos-switch

memory corruption

remote code execution

vulnerability

CVSS3

4.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

EPSS

0.004

Percentile

73.0%

JSON

A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "ArubaOS-Switch",
    "vendor": "Hewlett Packard Enterprise",
    "versions": [
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.11.xxxx: KB/WC/YA/YB/YC.16.11.0012 and below."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.10.xxxx: KB/WC/YA/YB/YC.16.10.0025 and below."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.10.xxxx: WB.16.10.23 and below."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.09.xxxx: All versions."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0026 and below."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.07.xxxx: All versions."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.06.xxxx: All versions."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.05.xxxx: All versions."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.04.xxxx: KA/RA.16.04.0026 and below."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.03.xxxx: All versions."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.02.xxxx: All versions."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 16.01.xxxx: All versions."
      },
      {
        "status": "affected",
        "version": "ArubaOS-Switch 15.xx.xxxx: 15.16.0025 and below."
      }
    ]
  }
]

References

www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-013.txt

CVSS3

4.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

EPSS

0.004

Percentile

73.0%

JSON

Related for CVELIST:CVE-2023-39268