CVE-2023-35972: An authenticated remote command injection vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to execute arbitra...

Summary

An authenticated remote command injection vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully c...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
arubanetworks	arubaos	>= 6.5.4.0, < 8.6.0.21 >= 8.7.0.0, < 8.10.0.7 >= 8.11.0.0, < 8.11.1.1 >= 10.4.0.0, < 10.4.0.2 `cpe:2.3:o:arubanetworks:arubaos::::::::`

Original advisory text

An authenticated remote command injection vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to execute arbitra...

An authenticated remote command injection vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt Vendor Advisory