certfr_avis - CERTFR-2025-AVI-0032

CERTFR-2025-AVI-0032

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans HPE Aruba Networking AOS. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

L’éditeur précise que les versions ArubaOS 6.5.4.x, 8.6.x, 8.7.x, 8.8.x, 8.9.x, 8.11.x, 10.3.x, 10.5.x, 10.6.x et SD-WAN 8.6.0.4-2.2.x, 8.7.0.0-2.3.0.x sont en fin de vie (EOL) et ne bénéficient plus de mises à jour de sécurité.

Impacted products

Vendor	Product	Description
HPE Aruba Networking	AOS	AOS versions 10.7.x antérieures à 10.7.0.0
HPE Aruba Networking	AOS	AOS versions 10.4.x antérieures à 10.4.1.5
HPE Aruba Networking	AOS	AOS versions 8.12.x antérieures à 8.12.0.3
HPE Aruba Networking	AOS	AOS versions 8.10.x antérieures à 8.10.0.15

References

Title

Publication Time

Tags

Bulletin de sécurité HPE Aruba Networking HPESBNW04723

2025-01-14

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "AOS versions 10.7.x ant\u00e9rieures \u00e0 10.7.0.0",
      "product": {
        "name": "AOS",
        "vendor": {
          "name": "HPE Aruba Networking",
          "scada": false
        }
      }
    },
    {
      "description": "AOS versions 10.4.x ant\u00e9rieures \u00e0 10.4.1.5",
      "product": {
        "name": "AOS",
        "vendor": {
          "name": "HPE Aruba Networking",
          "scada": false
        }
      }
    },
    {
      "description": "AOS versions 8.12.x ant\u00e9rieures \u00e0 8.12.0.3",
      "product": {
        "name": "AOS",
        "vendor": {
          "name": "HPE Aruba Networking",
          "scada": false
        }
      }
    },
    {
      "description": "AOS versions 8.10.x ant\u00e9rieures \u00e0 8.10.0.15",
      "product": {
        "name": "AOS",
        "vendor": {
          "name": "HPE Aruba Networking",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "L\u2019\u00e9diteur pr\u00e9cise que les versions ArubaOS 6.5.4.x, 8.6.x, 8.7.x, 8.8.x, 8.9.x, 8.11.x, 10.3.x, 10.5.x, 10.6.x et SD-WAN 8.6.0.4-2.2.x, 8.7.0.0-2.3.0.x sont en fin de vie (EOL) et ne b\u00e9n\u00e9ficient plus de mises \u00e0 jour de s\u00e9curit\u00e9.",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-23051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23051"
    },
    {
      "name": "CVE-2025-23052",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23052"
    }
  ],
  "links": [],
  "reference": "CERTFR-2025-AVI-0032",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-01-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans  HPE Aruba Networking AOS. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans HPE Aruba Networking AOS",
  "vendor_advisories": [
    {
      "published_at": "2025-01-14",
      "title": "Bulletin de s\u00e9curit\u00e9 HPE Aruba Networking HPESBNW04723",
      "url": "https://csaf.arubanetworks.com/2025/hpe_aruba_networking_-_hpesbnw04723.txt"
    }
  ]
}

CVE-2025-23051 (GCVE-0-2025-23051)

Vulnerability from cvelistv5 – Published: 2025-01-14 17:35 – Updated: 2025-01-23 21:18

Summary

An authenticated parameter injection vulnerability exists in the web-based management interface of the AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated user to leverage parameter injection to overwrite arbitrary system files.

Severity ?

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

hpe

References

URL

Tags

https://support.hpe.com/hpesc/public/docDisplay?d…

Impacted products

	Vendor	Product	Version
	Hewlett Packard Enterprise (HPE)	HPE Aruba Networking AOS	Affected: 10.4.0.0 , ≤ 10.4.1.4 (semver) Affected: 8.12.0.0 , ≤ 8.12.0.2 (semver) Affected: 8.10.0.0 , ≤ 8.10.0.14 (semver)

Credits

Erik de Jong (bugcrowd.com/erikdejong)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-23051",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-15T15:00:53.618751Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-23T21:18:23.255Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "HPE Aruba Networking AOS",
          "vendor": "Hewlett Packard Enterprise (HPE)",
          "versions": [
            {
              "lessThanOrEqual": "10.4.1.4",
              "status": "affected",
              "version": "10.4.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.0.2",
              "status": "affected",
              "version": "8.12.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.0.14",
              "status": "affected",
              "version": "8.10.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Erik de Jong (bugcrowd.com/erikdejong)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAn authenticated parameter injection vulnerability exists\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ein the web-based management interface of the AOS-8 and AOS-10\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eOperating Systems. Successful exploitation could allow an\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eauthenticated user to leverage parameter injection to overwrite\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003earbitrary system files.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "An authenticated parameter injection vulnerability exists\u00a0in the web-based management interface of the AOS-8 and AOS-10\u00a0Operating Systems. Successful exploitation could allow an\u00a0authenticated user to leverage parameter injection to overwrite\u00a0arbitrary system files."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-14T17:37:04.074Z",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04723en_us\u0026docLocale=en_US"
        }
      ],
      "source": {
        "advisory": "HPESBNW04723",
        "discovery": "EXTERNAL"
      },
      "title": "Authenticated Remote Code Execution in AOS Web-based Management Interface",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2025-23051",
    "datePublished": "2025-01-14T17:35:25.108Z",
    "dateReserved": "2025-01-10T16:27:25.924Z",
    "dateUpdated": "2025-01-23T21:18:23.255Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-23052 (GCVE-0-2025-23052)

Vulnerability from cvelistv5 – Published: 2025-01-14 17:38 – Updated: 2025-01-23 21:14

Summary

Authenticated command injection vulnerability in the command line interface of a network management service. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

Severity ?

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

hpe

References

URL

Tags

https://support.hpe.com/hpesc/public/docDisplay?d…

Impacted products

	Vendor	Product	Version
	Hewlett Packard Enterprise (HPE)	HPE Aruba Networking AOS	Affected: 10.4.0.0 , ≤ 10.4.1.4 (semver) Affected: 8.12.0.0 , ≤ 8.12.0.2 (semver) Affected: 8.10.0.0 , ≤ 8.10.0.14 (semver)

Credits

Erik de Jong (bugcrowd.com/erikdejong)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-23052",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-15T15:00:50.936408Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-77",
                "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-23T21:14:36.522Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "HPE Aruba Networking AOS",
          "vendor": "Hewlett Packard Enterprise (HPE)",
          "versions": [
            {
              "lessThanOrEqual": "10.4.1.4",
              "status": "affected",
              "version": "10.4.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.12.0.2",
              "status": "affected",
              "version": "8.12.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "8.10.0.14",
              "status": "affected",
              "version": "8.10.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Erik de Jong (bugcrowd.com/erikdejong)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAuthenticated command injection vulnerability in the command\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eline interface of a network management service. Successful\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eexploitation of this vulnerability could allow an attacker to execute\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003earbitrary commands as a privileged user on the underlying\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eoperating system.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Authenticated command injection vulnerability in the command\u00a0line interface of a network management service. Successful\u00a0exploitation of this vulnerability could allow an attacker to execute\u00a0arbitrary commands as a privileged user on the underlying\u00a0operating system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-14T17:38:43.844Z",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04723en_us\u0026docLocale=en_US"
        }
      ],
      "source": {
        "advisory": "HPESBNW04723",
        "discovery": "EXTERNAL"
      },
      "title": "Authenticated Command Injection Vulnerability allows Unauthorized Command Execution in CLI Interface",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2025-23052",
    "datePublished": "2025-01-14T17:38:43.844Z",
    "dateReserved": "2025-01-10T16:27:25.924Z",
    "dateUpdated": "2025-01-23T21:14:36.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2025-AVI-0032

Solutions

CVE-2025-23051 (GCVE-0-2025-23051)

CVE-2025-23052 (GCVE-0-2025-23052)

Tags

Sightings

Nomenclature