CVE-2022-23676

Published: May 10, 2022Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch 16.03.xxxx: All versions; ArubaOS-Switch 16.04.xxxx: All versions; ArubaOS-Switch 16.05.xxxx: All versions; ArubaOS-Switch 16.06.xxxx: All versions; ArubaOS-Switch 16.07.xxxx: All versions; ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0024 and below; ArubaOS-Switch 16.09.xxxx: KB/WB/WC/YA/YB/YC.16.09.0019 and below; ArubaOS-Switch 16.10.xxxx: KB/WB/WC/YA/YB/YC.16.10.0019 and below; ArubaOS-Switch 16.11.xxxx: KB/WB/WC/YA/YB/YC.16.11.0003 and below. Aruba has released upgrades for ArubaOS-Switch Devices that address these security vulnerabilities.

Affected (77)

Products: Arubanetworks: 5406r Firmware, 3810m Firmware, 2920 Firmware, 2930f Firmware, 2930m Firmware, 2530 Firmware, 2540 Firmware, 5412r Firmware, 2615 Firmware, 2620 Firmware, 2915 Firmware

11 products

Configuration A

7 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arubanetworks 5406r Firmware	From 15.00.0 to 15.16.0023
Arubanetworks 5406r Firmware	From 16.01.0 to 16.02.0034
Arubanetworks 5406r Firmware	From 16.03.0 to 16.04.0024
Arubanetworks 5406r Firmware	From 16.05.0 to 16.08.0025
Arubanetworks 5406r Firmware	From 16.09.0 to 16.09.0020
Arubanetworks 5406r Firmware	From 16.10.0 to 16.10.0020
Arubanetworks 5406r Firmware	From 16.11.0 to 16.11.0004

Running on/with	Platform Versions
Arubanetworks 5406r	All versions

Configuration B

7 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arubanetworks 3810m Firmware	From 15.00.0 to 15.16.0023
Arubanetworks 3810m Firmware	From 16.01.0 to 16.02.0034
Arubanetworks 3810m Firmware	From 16.03.0 to 16.04.0024
Arubanetworks 3810m Firmware	From 16.05.0 to 16.08.0025
Arubanetworks 3810m Firmware	From 16.09.0 to 16.09.0020
Arubanetworks 3810m Firmware	From 16.10.0 to 16.10.0020
Arubanetworks 3810m Firmware	From 16.11.0 to 16.11.0004

Running on/with	Platform Versions
Arubanetworks 3810m	All versions

Configuration C

7 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arubanetworks 2920 Firmware	From 15.00.0 to 15.16.0023
Arubanetworks 2920 Firmware	From 16.01.0 to 16.02.0034
Arubanetworks 2920 Firmware	From 16.03.0 to 16.04.0024
Arubanetworks 2920 Firmware	From 16.05.0 to 16.08.0025
Arubanetworks 2920 Firmware	From 16.09.0 to 16.09.0020
Arubanetworks 2920 Firmware	From 16.10.0 to 16.10.0020
Arubanetworks 2920 Firmware	From 16.11.0 to 16.11.0004

Running on/with	Platform Versions
Arubanetworks 2920	All versions

Configuration D

7 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arubanetworks 2930f Firmware	From 15.00.0 to 15.16.0023
Arubanetworks 2930f Firmware	From 16.01.0 to 16.02.0034
Arubanetworks 2930f Firmware	From 16.03.0 to 16.04.0024
Arubanetworks 2930f Firmware	From 16.05.0 to 16.08.0025
Arubanetworks 2930f Firmware	From 16.09.0 to 16.09.0020
Arubanetworks 2930f Firmware	From 16.10.0 to 16.10.0020
Arubanetworks 2930f Firmware	From 16.11.0 to 16.11.0004

Running on/with	Platform Versions
Arubanetworks 2930f	All versions

Configuration E

7 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arubanetworks 2930m Firmware	From 15.00.0 to 15.16.0023
Arubanetworks 2930m Firmware	From 16.01.0 to 16.02.0034
Arubanetworks 2930m Firmware	From 16.03.0 to 16.04.0024
Arubanetworks 2930m Firmware	From 16.05.0 to 16.08.0025
Arubanetworks 2930m Firmware	From 16.09.0 to 16.09.0020
Arubanetworks 2930m Firmware	From 16.10.0 to 16.10.0020
Arubanetworks 2930m Firmware	From 16.11.0 to 16.11.0004

Running on/with	Platform Versions
Arubanetworks 2930m	All versions

Configuration F

7 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arubanetworks 2530 Firmware	From 15.00.0 to 15.16.0023
Arubanetworks 2530 Firmware	From 16.01.0 to 16.02.0034
Arubanetworks 2530 Firmware	From 16.03.0 to 16.04.0024
Arubanetworks 2530 Firmware	From 16.05.0 to 16.08.0025
Arubanetworks 2530 Firmware	From 16.09.0 to 16.09.0020
Arubanetworks 2530 Firmware	From 16.10.0 to 16.10.0020
Arubanetworks 2530 Firmware	From 16.11.0 to 16.11.0004

Running on/with	Platform Versions
Arubanetworks 2530	All versions

Configuration G

7 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arubanetworks 2540 Firmware	From 15.00.0 to 15.16.0023
Arubanetworks 2540 Firmware	From 16.01.0 to 16.02.0034
Arubanetworks 2540 Firmware	From 16.03.0 to 16.04.0024
Arubanetworks 2540 Firmware	From 16.05.0 to 16.08.0025
Arubanetworks 2540 Firmware	From 16.09.0 to 16.09.0020
Arubanetworks 2540 Firmware	From 16.10.0 to 16.10.0020
Arubanetworks 2540 Firmware	From 16.11.0 to 16.11.0004

Running on/with	Platform Versions
Arubanetworks 2540	All versions

Configuration H

7 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arubanetworks 5412r Firmware	From 15.00.0 to 15.16.0023
Arubanetworks 5412r Firmware	From 16.01.0 to 16.02.0034
Arubanetworks 5412r Firmware	From 16.03.0 to 16.04.0024
Arubanetworks 5412r Firmware	From 16.05.0 to 16.08.0025
Arubanetworks 5412r Firmware	From 16.09.0 to 16.09.0020
Arubanetworks 5412r Firmware	From 16.10.0 to 16.10.0020
Arubanetworks 5412r Firmware	From 16.11.0 to 16.11.0004

Running on/with	Platform Versions
Arubanetworks 5412r	All versions

Configuration I

7 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arubanetworks 2615 Firmware	From 15.00.0 to 15.16.0023
Arubanetworks 2615 Firmware	From 16.01.0 to 16.02.0034
Arubanetworks 2615 Firmware	From 16.03.0 to 16.04.0024
Arubanetworks 2615 Firmware	From 16.05.0 to 16.08.0025
Arubanetworks 2615 Firmware	From 16.09.0 to 16.09.0020
Arubanetworks 2615 Firmware	From 16.10.0 to 16.10.0020
Arubanetworks 2615 Firmware	From 16.11.0 to 16.11.0004

Running on/with	Platform Versions
Arubanetworks 2615	All versions

Configuration J

7 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arubanetworks 2620 Firmware	From 15.00.0 to 15.16.0023
Arubanetworks 2620 Firmware	From 16.01.0 to 16.02.0034
Arubanetworks 2620 Firmware	From 16.03.0 to 16.04.0024
Arubanetworks 2620 Firmware	From 16.05.0 to 16.08.0025
Arubanetworks 2620 Firmware	From 16.09.0 to 16.09.0020
Arubanetworks 2620 Firmware	From 16.10.0 to 16.10.0020
Arubanetworks 2620 Firmware	From 16.11.0 to 16.11.0004

Running on/with	Platform Versions
Arubanetworks 2620	All versions

Configuration K

7 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Arubanetworks 2915 Firmware	From 15.00.0 to 15.16.0023
Arubanetworks 2915 Firmware	From 16.01.0 to 16.02.0034
Arubanetworks 2915 Firmware	From 16.03.0 to 16.04.0024
Arubanetworks 2915 Firmware	From 16.05.0 to 16.08.0025
Arubanetworks 2915 Firmware	From 16.09.0 to 16.09.0020
Arubanetworks 2915 Firmware	From 16.10.0 to 16.10.0020
Arubanetworks 2915 Firmware	From 16.11.0 to 16.11.0004

Running on/with	Platform Versions
Arubanetworks 2915	All versions

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (2)

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-008.txt

Source: security-alert@hpe.com

Vendor Advisory

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-008.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.