9.8
Critical
CVE-2023-35980 There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code…
Description
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Aruba Access Points running InstantOS and ArubaOS 10 | Versions not published | |
| arba_access_points_running_instantos_and_arubaos_10 10.4 | earliest → < 10.4.0.1 | 10.4.0.1 |
| arba_access_points_running_instantos_and_arubaos_10 8.11 | earliest → < 8.11.1.0 | 8.11.1.0 |
| arba_access_points_running_instantos_and_arubaos_10 8.10 | earliest → < 8.10.0.6 | 8.10.0.6 |
| arba_access_points_running_instantos_and_arubaos_10 8.6 | earliest → < 8.6.0.20 | 8.6.0.20 |
| arba_access_points_running_instantos_and_arubaos_10 6.5 | earliest → < 6.5.4.24 | 6.5.4.24 |
| arba_access_points_running_instantos_and_arubaos_10 4.2 | earliest → < 4.2.4.21 | 4.2.4.21 |
Other CVEs of Aruba Access Points running InstantOS and ArubaOS 10
The 16 CVEs of Aruba Access Points running InstantOS and ArubaOS 10 →
CVE-2023-35982
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code…
9.8
Critical
CVE-2023-35981
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code…
9.8
Critical
CVE-2023-22791
A vulnerability exists in Aruba InstantOS and ArubaOS 10 where an edge-case combination of network configuration,…
5.4
Medium
CVE-2023-22790
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command…
7.2
High