CVE-2023-35972
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
28.6%
An authenticated remote command injection vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| arubanetworks | arubaos | * | cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:* |
| arubanetworks | mc-va-10 | - | cpe:2.3:a:arubanetworks:mc-va-10:-:*:*:*:*:*:*:* |
| arubanetworks | mc-va-1k | - | cpe:2.3:a:arubanetworks:mc-va-1k:-:*:*:*:*:*:*:* |
| arubanetworks | mc-va-250 | - | cpe:2.3:a:arubanetworks:mc-va-250:-:*:*:*:*:*:*:* |
| arubanetworks | mc-va-50 | - | cpe:2.3:a:arubanetworks:mc-va-50:-:*:*:*:*:*:*:* |
| arubanetworks | mcr-va-10k | - | cpe:2.3:a:arubanetworks:mcr-va-10k:-:*:*:*:*:*:*:* |
| arubanetworks | mcr-va-1k | - | cpe:2.3:a:arubanetworks:mcr-va-1k:-:*:*:*:*:*:*:* |
| arubanetworks | mcr-va-50 | - | cpe:2.3:a:arubanetworks:mcr-va-50:-:*:*:*:*:*:*:* |
| arubanetworks | mcr-va-500 | - | cpe:2.3:a:arubanetworks:mcr-va-500:-:*:*:*:*:*:*:* |
| arubanetworks | mcr-va-5k | - | cpe:2.3:a:arubanetworks:mcr-va-5k:-:*:*:*:*:*:*:* |
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
28.6%