Vulnerabilites related to hpe - aruba_cx_6000_24g
cve-2023-3718
Vulnerability from cvelistv5
Published
2023-08-01 18:25
Modified
2024-10-22 20:29
Severity ?
EPSS score ?
Summary
An authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands on the underlying operating system as a privileged user on the affected switch. This allows an attacker to fully compromise the underlying operating system on the device running AOS-CX.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | Aruba CX Switches |
Version: AOS-CX 10.11.xxxx: 10.11.1010 and below Version: AOS-CX 10.10.xxxx: 10.10.1050 and below |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T07:01:57.375Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-010.txt", }, ], title: "CVE Program Container", }, { affected: [ { cpes: [ "cpe:2.3:a:hewlett_packard_enterprise:aruba_cx_switches:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "aruba_cx_switches", vendor: "hewlett_packard_enterprise", versions: [ { lessThanOrEqual: "10.11.1010", status: "affected", version: "10.11", versionType: "custom", }, { lessThanOrEqual: "10.10.1050", status: "affected", version: "10.10", versionType: "custom", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2023-3718", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-10-22T20:21:25.652996Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-22T20:29:41.391Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", platforms: [ "AOS-CX", ], product: "Aruba CX Switches", vendor: "Hewlett Packard Enterprise (HPE)", versions: [ { status: "affected", version: "AOS-CX 10.11.xxxx: 10.11.1010 and below", }, { status: "affected", version: "AOS-CX 10.10.xxxx: 10.10.1050 and below", }, ], }, ], credits: [ { lang: "en", type: "finder", user: "00000000-0000-4000-9000-000000000000", value: "Nick Starke of Aruba Threat Labs", }, ], descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "\n\n<pre>An authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands on the underlying operating system as a privileged user on the affected switch. This allows an attacker to fully compromise the underlying operating system on the device running AOS-CX.</pre>\n\n", }, ], value: "\nAn authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands on the underlying operating system as a privileged user on the affected switch. This allows an attacker to fully compromise the underlying operating system on the device running AOS-CX.\n\n\n\n", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], providerMetadata: { dateUpdated: "2023-08-01T18:25:10.262Z", orgId: "eb103674-0d28-4225-80f8-39fb86215de0", shortName: "hpe", }, references: [ { url: "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-010.txt", }, ], source: { discovery: "UNKNOWN", }, title: "Authenticated Command Injection Vulnerability in AOS-CX Command Line Interface", x_generator: { engine: "Vulnogram 0.1.0-dev", }, }, }, cveMetadata: { assignerOrgId: "eb103674-0d28-4225-80f8-39fb86215de0", assignerShortName: "hpe", cveId: "CVE-2023-3718", datePublished: "2023-08-01T18:25:10.262Z", dateReserved: "2023-07-17T17:36:17.204Z", dateUpdated: "2024-10-22T20:29:41.391Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
Vulnerability from fkie_nvd
Published
2023-08-01 19:15
Modified
2024-11-21 08:17
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
An authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands on the underlying operating system as a privileged user on the affected switch. This allows an attacker to fully compromise the underlying operating system on the device running AOS-CX.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security-alert@hpe.com | https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-010.txt | Mitigation, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-010.txt | Mitigation, Vendor Advisory |
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", matchCriteriaId: "04DE53FD-22EA-4BDF-97DD-AB8253F4F059", versionEndIncluding: "10.10.1050", versionStartIncluding: "10.10.0000", vulnerable: true, }, { criteria: "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", matchCriteriaId: "2649063A-E4A1-4548-877E-F1FAD3BBFC56", versionEndIncluding: "10.11.1010", versionStartIncluding: "10.11.0000", vulnerable: true, }, ], negate: false, operator: "OR", }, { cpeMatch: [ { criteria: "cpe:2.3:h:hpe:aruba_cx_10000-48y6:-:*:*:*:*:*:*:*", matchCriteriaId: "D10D4824-3D75-4CD2-A541-D910B91FD560", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_4100i:-:*:*:*:*:*:*:*", matchCriteriaId: "B7C2B56C-203F-4290-BCE7-8BD751DF9CEF", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_6000_12g:-:*:*:*:*:*:*:*", matchCriteriaId: "8E276AD3-DEBD-4BE5-A7E0-A2017E09ADC8", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_6000_24g:-:*:*:*:*:*:*:*", matchCriteriaId: "A51A5922-69A1-4594-B74F-27E62E455170", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_6000_48g:-:*:*:*:*:*:*:*", matchCriteriaId: "D397073F-2A04-4B88-BC6D-5F3B5EEB00F8", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_6100:-:*:*:*:*:*:*:*", matchCriteriaId: "FF1DD310-3D31-4204-92E0-70C33EE44F08", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_6200f:-:*:*:*:*:*:*:*", matchCriteriaId: "FCD1A83B-109B-4596-AE37-706751E2B57D", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_6200f_48g:-:*:*:*:*:*:*:*", matchCriteriaId: "F9BC4F4F-5DF6-45D6-9039-BF06C5D53487", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_6200m:-:*:*:*:*:*:*:*", matchCriteriaId: "1218AAA5-01ED-4D89-A7AE-A600356ABD46", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_6200m_24g:-:*:*:*:*:*:*:*", matchCriteriaId: "D05337A1-9022-41DA-AFED-AE76FC39D3C6", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_6300m_24p:-:*:*:*:*:*:*:*", matchCriteriaId: "5172FB6C-C38E-4A5A-8C67-55B475C96B0A", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_6300m_48g:-:*:*:*:*:*:*:*", matchCriteriaId: "3FF6C6CE-E842-420D-9C4C-54D4B4F85D14", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_6405:-:*:*:*:*:*:*:*", matchCriteriaId: "D118A9A6-BBA4-4149-AE0D-1DA2EB45B53F", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_6410:-:*:*:*:*:*:*:*", matchCriteriaId: "790C5E7A-3405-4873-83E8-4D9C0FEC5E6D", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_8320-32:-:*:*:*:*:*:*:*", matchCriteriaId: "873275E0-0BF3-42A6-A88A-4A4CDCC98C37", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_8320-48p:-:*:*:*:*:*:*:*", matchCriteriaId: "65875CB1-A9A3-42CC-A14D-7AB4E985808A", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_8325-32c:-:*:*:*:*:*:*:*", matchCriteriaId: "59B7E2D3-0B72-4A78-AEFA-F106FAD38156", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_8325-48y8c:-:*:*:*:*:*:*:*", matchCriteriaId: "7E87A92B-4EE5-4235-A0DA-195F27841DBB", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_8360-12c:-:*:*:*:*:*:*:*", matchCriteriaId: "6BC24E52-13C0-402F-9ABF-A1DE51719AEF", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_8360-16y2c:-:*:*:*:*:*:*:*", matchCriteriaId: "76EF979E-061A-42A3-B161-B835E92ED180", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_8360-24xf2c:-:*:*:*:*:*:*:*", matchCriteriaId: "DE04919C-9289-4FB3-938F-F8BB15EC6A74", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_8360-32y4c:-:*:*:*:*:*:*:*", matchCriteriaId: "B630C64B-C474-477D-A80B-A0FB73ACCC49", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_8360-48xt4c:-:*:*:*:*:*:*:*", matchCriteriaId: "53ABE8B8-A4F6-400B-A893-314BE24D06B8", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_8360-48y6c:-:*:*:*:*:*:*:*", matchCriteriaId: "C44383CC-3751-455E-B1AB-39B16F40DC76", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_8400:-:*:*:*:*:*:*:*", matchCriteriaId: "B25A9CD2-5E5F-4BDB-8707-5D6941411A2B", vulnerable: false, }, { criteria: "cpe:2.3:h:hpe:aruba_cx_9300_32d:-:*:*:*:*:*:*:*", matchCriteriaId: "6C595A15-BD04-45A3-A719-3DFB8DAB46E7", vulnerable: false, }, ], negate: false, operator: "OR", }, ], operator: "AND", }, ], cveTags: [], descriptions: [ { lang: "en", value: "\nAn authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands on the underlying operating system as a privileged user on the affected switch. This allows an attacker to fully compromise the underlying operating system on the device running AOS-CX.\n\n\n\n", }, { lang: "es", value: "Existe una vulnerabilidad de inyección de comandos autenticados en la interfaz de línea de comandos de AOS-CX. La explotación exitosa de esta vulnerabilidad resulta en la capacidad de ejecutar comandos arbitrarios en el sistema operativo subyacente como un usuario privilegiado en el conmutador afectado. Esto permite a un atacante comprometer completamente el sistema operativo subyacente en el dispositivo que ejecuta AOS-CX.", }, ], id: "CVE-2023-3718", lastModified: "2024-11-21T08:17:54.727", metrics: { cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 5.9, source: "security-alert@hpe.com", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 2.8, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2023-08-01T19:15:09.947", references: [ { source: "security-alert@hpe.com", tags: [ "Mitigation", "Vendor Advisory", ], url: "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-010.txt", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Mitigation", "Vendor Advisory", ], url: "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-010.txt", }, ], sourceIdentifier: "security-alert@hpe.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-77", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }