Aruba Instant (IAP)
At a glance
- Source
- NVD
- EPSS
- EPSS 4.63 % · percentile 92 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hpe
- NVD status
- Modified
Description
A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system commands within the underlying operating system. An attacker could use this ability to copy files, read configuration, write files, delete files, or reboot the device. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.1
Weaknesses (CWE)
- CWE-78 — Improper Neutralization of Special Elements used in an OS Command
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2018-18827
- GCVE · GCVE-0-2018-7084
CERT-FR advisories
- CERTFR-2019-AVI-207 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2019-AVI-083 — Multiples vulnérabilités dans Aruba Instant · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:arubanetworks:aruba_instant:*:*:*:*:*:*:*:*≥ 4.0 < 4.2.4.12cpe:2.3:a:arubanetworks:aruba_instant:*:*:*:*:*:*:*:*≥ 6.5.0 < 6.5.4.11cpe:2.3:a:arubanetworks:aruba_instant:*:*:*:*:*:*:*:*≥ 8.3.0 < 8.3.0.6cpe:2.3:a:arubanetworks:aruba_instant:*:*:*:*:*:*:*:*≥ 8.4.0 < 8.4.0.1cpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:*< 8.4.0.1
Affected products
| Product | Versions |
|---|---|
| Aruba Instant (IAP) | affected Aruba Instant 4.x prior to 6.4.4.8 - 4.2.4.12 Aruba Instant 6.5.x prior to 6.5.4.11 Aruba Instant 8.3.x prior to 8.3.0.6 Aruba Instant 8.4.x prior to 8.4.0.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |