CVE-2016-2031
Aruba Authentication Bypass / Insecure Transport / Tons Of Issues
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to insufficient validation of user-supplied input and insufficient checking of parameters, which could allow a malicious user to bypass security restrictions, obtain sensitive information, perform unauthorized actions and execute arbitrary code.
Se presentan múltiples vulnerabilidades en Aruba Instate versiones anteriores a 4.1.3.0 y 4.2.3.1, debido a una comprobación insuficiente de la entrada suministrada por el usuario y una comprobación insuficiente de los parámetros, lo que podría permitir a un usuario malicioso omitir las restricciones de seguridad, obtener información confidencial, llevar a cabo acciones no autorizadas y ejecutar código arbitrario.
Multiple vulnerabilities were identified in Aruba AP, IAP and AMP devices. The vulnerabilities were discovered during a black box security assessment and therefore the vulnerability list should not be considered exhaustive. Several of the high severity vulnerabilities listed in this report are related to the Aruba proprietary PAPI protocol and allow remote compromise of affected devices.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-01-22 CVE Reserved
- 2016-05-06 CVE Published
- 2023-11-20 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-431802.pdf | Third Party Advisory |
|
| https://www.securityfocus.com/bid/90207 | Broken Link |
| URL | Date | SRC |
|---|---|---|
| http://packetstormsecurity.com/files/136997/Aruba-Authentication-Bypass-Insecure-Transport-Tons-Of-Issues.html | 2024-08-05 | |
| http://seclists.org/fulldisclosure/2016/May/19 | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-004.txt | 2022-11-10 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Siemens Search vendor "Siemens" | Scalance W1750d Firmware Search vendor "Siemens" for product "Scalance W1750d Firmware" | * | - |
Affected
| in | Siemens Search vendor "Siemens" | Scalance W1750d Search vendor "Siemens" for product "Scalance W1750d" | - | - |
Safe
|
| Arubanetworks Search vendor "Arubanetworks" | Airwave Search vendor "Arubanetworks" for product "Airwave" | >= < 8.2.0.0 Search vendor "Arubanetworks" for product "Airwave" and version " >= < 8.2.0.0" | - |
Affected
| ||||||
| Arubanetworks Search vendor "Arubanetworks" | Aruba Instant Search vendor "Arubanetworks" for product "Aruba Instant" | < 4.1.3.0 Search vendor "Arubanetworks" for product "Aruba Instant" and version " < 4.1.3.0" | - |
Affected
| ||||||
| Arubanetworks Search vendor "Arubanetworks" | Aruba Instant Search vendor "Arubanetworks" for product "Aruba Instant" | 4.2.3.1 Search vendor "Arubanetworks" for product "Aruba Instant" and version "4.2.3.1" | - |
Affected
| ||||||
| Arubanetworks Search vendor "Arubanetworks" | Arubaos Search vendor "Arubanetworks" for product "Arubaos" | * | - |
Affected
| ||||||