Log in Start free

Vulnerability · Published May 10, 2022 · Assigned by hpe

CVE-2022-23676

Critical 9.8

In plain English

A critical-severity security flaw in ArubaOS-Switch Devices. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 23.0% (higher than 98% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)23.0%top 2.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch 16.03.xxxx: All versions; ArubaOS-Switch 16.04.xxxx: All versions; ArubaOS-Switch 16.05.xxxx: All versions; ArubaOS-Switch 16.06.xxxx: All versions; ArubaOS-Switch 16.07.xxxx: All versions; ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0024 and below; ArubaOS-Switch 16.09.xxxx: KB/WB/WC/YA/YB/YC.16.09.0019 and below; ArubaOS-Switch 16.10.xxxx: KB/WB/WC/YA/YB/YC.16.10.0019 and below; ArubaOS-Switch 16.11.xxxx: KB/WB/WC/YA/YB/YC.16.11.0003 and below. Aruba has released upgrades for ArubaOS-Switch Devices that address these security vulnerabilities.

Affected products (as reported)

VendorProductVersions
n/a ArubaOS-Switch Devices ArubaOS-Switch 15.xx.xxxx: All versionsArubaOS-Switch 16.01.xxxx: All versionsArubaOS-Switch 16.02.xxxx: K.16.02.0033 and belowArubaOS-Switch 16.03.xxxx: All versionsArubaOS-Switch 16.04.xxxx: All versionsArubaOS-Switch 16.05.xxxx: All versionsArubaOS-Switch 16.06.xxxx: All versionsArubaOS-Switch 16.07.xxxx: All versions

References