Skip to main content

Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
  1. Home
  2. Alerts & Advisories
  3. Alerts
  4. Critical Vulnerabilities in ArubaOS
Alerts

Critical Vulnerabilities in ArubaOS

2 March 2023

Aruba Networks has released security updates addressing multiple critical vulnerabilities in its operating system, ArubaOS.

These vulnerabilities are due to command injection flaws (CVE-2023-22747, CVE-2023-22748, CVE-2023-22749, and CVE-2023-22750) and stack-based buffer overflow problems (CVE-2023-22751 and CVE-2023-22752) in the PAPI (Aruba Networks access point management protocol).

Successful exploitation of these vulnerabilities could allow a remote and unauthenticated attacker to execute arbitrary code as a privileged user on ArubaOS. This is done by sending a specially crafted packet to the PAPI over UDP port 8211.

The affected versions of ArubaOS, including a few that have reached End of Life (EoL), are as follows:

  • ArubaOS 8.6.0.19 and below

  • ArubaOS 8.10.0.4 and below

  • ArubaOS 10.3.1.0 and below

  • SD-WAN 8.7.0.0-2.3.0.8 and below

  • ArubaOS 6.5.4.x (EoL)

  • ArubaOS 8.7.x.x (EoL)

  • ArubaOS 8.8.x.x (EoL)

  • ArubaOS 8.9.x.x (EoL)

  • SD-WAN 8.6.0.4-2.2.x.x (EoL)


Users and administrators of affected product versions are advised to upgrade to the latest versions immediately. For products which have reached EoL, a workaround is available by enabling the "Enhanced PAPI Security" mode using a non-default key.

More information is available here:

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt

https://www.bleepingcomputer.com/news/security/aruba-networks-fixes-six-critical-vulnerabilities-in-arubaos/


Back to top