FKIE_CVE-2022-37905

Vulnerability from fkie_nvd - Published: 2022-12-12 13:15 - Updated: 2025-05-02 19:15
Severity ?
6.6 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.
References
security-alert@hpe.comhttps://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txtVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txtVendor Advisory
Impacted products
Vendor Product Version
arubanetworks sd-wan *
arubanetworks arubaos *
arubanetworks arubaos *
arubanetworks arubaos *
arubanetworks arubaos *
arubanetworks arubaos 10.3.0.0
arubanetworks 7005 -
arubanetworks 7008 -
arubanetworks 7010 -
arubanetworks 7024 -
arubanetworks 7030 -
arubanetworks 7205 -
arubanetworks 7210 -
arubanetworks 7220 -
arubanetworks 7240xm -
arubanetworks 7280 -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CF50C4E-038A-4120-BF86-05DF607C59CB",
              "versionEndExcluding": "8.7.0.0-2.3.0.6",
              "versionStartIncluding": "8.7.0.0-2.3.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "49CE5580-518E-4CC8-894A-A78F476D6EC7",
              "versionEndExcluding": "6.5.4.22",
              "versionStartIncluding": "6.5.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "58A7807B-5AD1-4CE1-8974-772067778D97",
              "versionEndExcluding": "8.6.0.17",
              "versionStartIncluding": "8.4.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F077A2FC-EE0D-4D8F-A5E1-A1BE3285EFDD",
              "versionEndExcluding": "8.7.1.9",
              "versionStartIncluding": "8.7.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0AAF010C-30AB-43D2-BAAB-813B869675FB",
              "versionEndIncluding": "8.9.0.3",
              "versionStartIncluding": "8.8.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "84A36EB0-A525-4B05-B9CE-A31145A7157C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE128072-9444-40D5-AC86-BB317869EB97",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F747F71E-66BC-4776-BCCC-3123F8EEEBC6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "59612211-5054-44DC-B028-61A2C5C6133D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "15FE873C-3C45-4EA3-9AD1-D07F132BC31F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8E68DB6-149B-4469-BD27-69F1AC59166F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2E9AA178-1327-402E-8740-8409ECA448BC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9969F899-4D7A-4DD5-B81D-DB16B20CF86A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF33BAD0-0596-4910-B096-99E2033F73D8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FDDFDA5E-3895-463A-86EA-1823EC1B5045",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3BBA9A71-BE10-471A-A8BE-5CCB8CE8393F",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.\n\n"
    },
    {
      "lang": "es",
      "value": "Existen vulnerabilidades en ArubaOS que se ejecutan en controladores de la serie 7xxx que permiten a un atacante ejecutar c\u00f3digo arbitrario durante la secuencia de inicio. La explotaci\u00f3n exitosa podr\u00eda permitir a un atacante lograr una modificaci\u00f3n permanente del sistema operativo subyacente."
    }
  ],
  "id": "CVE-2022-37905",
  "lastModified": "2025-05-02T19:15:51.803",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.7,
        "impactScore": 5.9,
        "source": "security-alert@hpe.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-12-12T13:15:12.990",
  "references": [
    {
      "source": "security-alert@hpe.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt"
    }
  ],
  "sourceIdentifier": "security-alert@hpe.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1236"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.