Aruba Instant (IAP)
En bref
- Source
- NVD
- EPSS
- EPSS 4.63 % · centile 92 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- hpe
- Statut NVD
- Modified
Description
A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system commands within the underlying operating system. An attacker could use this ability to copy files, read configuration, write files, delete files, or reboot the device. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.1
Faiblesses (CWE)
- CWE-78 — Injection de commande système
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2018-18827
- GCVE · GCVE-0-2018-7084
Avis du CERT-FR
- CERTFR-2019-AVI-207 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2019-AVI-083 — Multiples vulnérabilités dans Aruba Instant · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:arubanetworks:aruba_instant:*:*:*:*:*:*:*:*≥ 4.0 < 4.2.4.12cpe:2.3:a:arubanetworks:aruba_instant:*:*:*:*:*:*:*:*≥ 6.5.0 < 6.5.4.11cpe:2.3:a:arubanetworks:aruba_instant:*:*:*:*:*:*:*:*≥ 8.3.0 < 8.3.0.6cpe:2.3:a:arubanetworks:aruba_instant:*:*:*:*:*:*:*:*≥ 8.4.0 < 8.4.0.1cpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:*< 8.4.0.1
Produits affectés
| Produit | Versions |
|---|---|
| Aruba Instant (IAP) | affected Aruba Instant 4.x prior to 6.4.4.8 - 4.2.4.12 Aruba Instant 6.5.x prior to 6.5.4.11 Aruba Instant 8.3.x prior to 8.3.0.6 Aruba Instant 8.4.x prior to 8.4.0.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |