CVE-2023-37426 (GCVE-0-2023-37426)

Vulnerability from cvelistv5 – Published: 2023-08-22 18:02 – Updated: 2024-10-03 15:04
VLAI?
Summary
EdgeConnect SD-WAN Orchestrator instances prior to the versions resolved in this advisory were found to have shared static SSH host keys for all installations. This vulnerability could allow an attacker to spoof the SSH host signature and thereby masquerade as a legitimate Orchestrator host.
Severity ?
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Assigner
hpe
References
Impacted products
Vendor Product Version
Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator Affected: Orchestrator 9.3.x , ≤ <=9.3.0 (semver)
Affected: Orchestrator 9.2.x , ≤ <=9.2.5 (semver)
Affected: Orchestrator 9.1.x , ≤ <=9.1.7 (semver)
Create a notification for this product.
Credits
Dean Freeman Carmody Rauch
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:16:29.531Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:hpe:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "edgeconnect_sd-wan_orchestrator",
            "vendor": "hpe",
            "versions": [
              {
                "lessThanOrEqual": "9.1.7",
                "status": "affected",
                "version": "9.1x",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:hpe:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "edgeconnect_sd-wan_orchestrator",
            "vendor": "hpe",
            "versions": [
              {
                "lessThanOrEqual": "9.2.5",
                "status": "affected",
                "version": "9.2x",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:hpe:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "edgeconnect_sd-wan_orchestrator",
            "vendor": "hpe",
            "versions": [
              {
                "lessThanOrEqual": "9.3.0",
                "status": "affected",
                "version": "9.3x",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-37426",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-03T14:55:28.579141Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-03T15:04:38.699Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "EdgeConnect SD-WAN Orchestrator",
          "vendor": "Hewlett Packard Enterprise (HPE)",
          "versions": [
            {
              "lessThanOrEqual": "\u003c=9.3.0",
              "status": "affected",
              "version": "Orchestrator 9.3.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=9.2.5",
              "status": "affected",
              "version": "Orchestrator 9.2.x",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=9.1.7",
              "status": "affected",
              "version": "Orchestrator 9.1.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Dean Freeman"
        },
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Carmody Rauch"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "EdgeConnect SD-WAN Orchestrator instances prior to the\u0026nbsp;versions resolved in this advisory were found to have\u0026nbsp;shared static SSH host keys for all installations. This\u0026nbsp;vulnerability could allow an attacker to spoof the SSH host\u0026nbsp;signature and thereby masquerade as a legitimate Orchestrator\u003cbr\u003ehost."
            }
          ],
          "value": "EdgeConnect SD-WAN Orchestrator instances prior to the\u00a0versions resolved in this advisory were found to have\u00a0shared static SSH host keys for all installations. This\u00a0vulnerability could allow an attacker to spoof the SSH host\u00a0signature and thereby masquerade as a legitimate Orchestrator\nhost."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-22T18:02:22.824Z",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Shared SSH Static Host Keys in EdgeConnect SD-WAN Orchestrator",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2023-37426",
    "datePublished": "2023-08-22T18:02:22.824Z",
    "dateReserved": "2023-07-05T17:36:47.997Z",
    "dateUpdated": "2024-10-03T15:04:38.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"9.0.0\", \"versionEndIncluding\": \"9.0.5\", \"matchCriteriaId\": \"5E893AD7-C02C-4608-AF2E-01FDF300DFF0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"9.1.0\", \"versionEndIncluding\": \"9.1.7\", \"matchCriteriaId\": \"A49FCAD2-9EAA-4A38-9416-96C130C6E3CE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"9.2.0\", \"versionEndIncluding\": \"9.2.5\", \"matchCriteriaId\": \"7B72D752-0E1E-4D9F-8DE7-848EA8161402\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"141D0310-AE35-48FA-953A-1F2019370717\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"EdgeConnect SD-WAN Orchestrator instances prior to the\\u00a0versions resolved in this advisory were found to have\\u00a0shared static SSH host keys for all installations. This\\u00a0vulnerability could allow an attacker to spoof the SSH host\\u00a0signature and thereby masquerade as a legitimate Orchestrator\\nhost.\"}]",
      "id": "CVE-2023-37426",
      "lastModified": "2024-11-21T08:11:41.097",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-alert@hpe.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"baseScore\": 7.4, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.2}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2023-08-22T19:16:37.210",
      "references": "[{\"url\": \"https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt\", \"source\": \"security-alert@hpe.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "security-alert@hpe.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-798\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-37426\",\"sourceIdentifier\":\"security-alert@hpe.com\",\"published\":\"2023-08-22T19:16:37.210\",\"lastModified\":\"2024-11-21T08:11:41.097\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"EdgeConnect SD-WAN Orchestrator instances prior to the\u00a0versions resolved in this advisory were found to have\u00a0shared static SSH host keys for all installations. This\u00a0vulnerability could allow an attacker to spoof the SSH host\u00a0signature and thereby masquerade as a legitimate Orchestrator\\nhost.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-alert@hpe.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.0\",\"versionEndIncluding\":\"9.0.5\",\"matchCriteriaId\":\"5E893AD7-C02C-4608-AF2E-01FDF300DFF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.1.0\",\"versionEndIncluding\":\"9.1.7\",\"matchCriteriaId\":\"A49FCAD2-9EAA-4A38-9416-96C130C6E3CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.2.0\",\"versionEndIncluding\":\"9.2.5\",\"matchCriteriaId\":\"7B72D752-0E1E-4D9F-8DE7-848EA8161402\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"141D0310-AE35-48FA-953A-1F2019370717\"}]}]}],\"references\":[{\"url\":\"https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt\",\"source\":\"security-alert@hpe.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T17:16:29.531Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-37426\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-03T14:55:28.579141Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:hpe:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*\"], \"vendor\": \"hpe\", \"product\": \"edgeconnect_sd-wan_orchestrator\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.1x\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"9.1.7\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:hpe:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*\"], \"vendor\": \"hpe\", \"product\": \"edgeconnect_sd-wan_orchestrator\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.2x\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"9.2.5\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:hpe:edgeconnect_sd-wan_orchestrator:*:*:*:*:*:*:*:*\"], \"vendor\": \"hpe\", \"product\": \"edgeconnect_sd-wan_orchestrator\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.3x\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"9.3.0\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-03T15:04:31.341Z\"}}], \"cna\": {\"title\": \"Shared SSH Static Host Keys in EdgeConnect SD-WAN Orchestrator\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Dean Freeman\"}, {\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Carmody Rauch\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Hewlett Packard Enterprise (HPE)\", \"product\": \"EdgeConnect SD-WAN Orchestrator\", \"versions\": [{\"status\": \"affected\", \"version\": \"Orchestrator 9.3.x\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"\u003c=9.3.0\"}, {\"status\": \"affected\", \"version\": \"Orchestrator 9.2.x\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"\u003c=9.2.5\"}, {\"status\": \"affected\", \"version\": \"Orchestrator 9.1.x\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"\u003c=9.1.7\"}], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"EdgeConnect SD-WAN Orchestrator instances prior to the\\u00a0versions resolved in this advisory were found to have\\u00a0shared static SSH host keys for all installations. This\\u00a0vulnerability could allow an attacker to spoof the SSH host\\u00a0signature and thereby masquerade as a legitimate Orchestrator\\nhost.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"EdgeConnect SD-WAN Orchestrator instances prior to the\u0026nbsp;versions resolved in this advisory were found to have\u0026nbsp;shared static SSH host keys for all installations. This\u0026nbsp;vulnerability could allow an attacker to spoof the SSH host\u0026nbsp;signature and thereby masquerade as a legitimate Orchestrator\u003cbr\u003ehost.\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"eb103674-0d28-4225-80f8-39fb86215de0\", \"shortName\": \"hpe\", \"dateUpdated\": \"2023-08-22T18:02:22.824Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-37426\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-03T15:04:38.699Z\", \"dateReserved\": \"2023-07-05T17:36:47.997Z\", \"assignerOrgId\": \"eb103674-0d28-4225-80f8-39fb86215de0\", \"datePublished\": \"2023-08-22T18:02:22.824Z\", \"assignerShortName\": \"hpe\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.