Vulnerability · Published Aug 29, 2023 · Assigned by vmware
CVE-2023-34039
Critical 9.8
In plain English
A critical-severity security flaw in Aria Operations for Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 67.2% (higher than 99.3% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)67.2%top 0.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling3Metasploit, Nuclei, Public PoC
Official description
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Aria Operations for Networks | Aria Operations for Networks 6.x |