CVE-2022-37891
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in the execution of arbitrary commands on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities.
Se presentan vulnerabilidades de desbordamiento de búfer no autenticado en la interfaz de administración web de Aruba InstantOS y ArubaOS versión 10. Una explotación exitosa resulta en la ejecución de comandos arbitrarios en el sistema operativo subyacente de Aruba InstantOS versiones 6.4.x: 6.4.4.8-4.2.4.20 y anteriores; Aruba InstantOS 6.5.x: 6.5.4.23 y anteriores; Aruba InstantOS 8.6.x: 8.6. 0.18 y anteriores; Aruba InstantOS 8.7.x: 8.7.1.9 y anteriores; Aruba InstantOS 8.10.x: 8.10.0.1 y anteriores; ArubaOS 10.3.x: 10.3.1.0 y anteriores; Aruba ha publicado actualizaciones para Aruba InstantOS que abordan estas vulnerabilidades de seguridad
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-08-08 CVE Reserved
- 2022-10-07 CVE Published
- 2024-04-29 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt | 2022-11-09 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Siemens Search vendor "Siemens" | Scalance W1750d Firmware Search vendor "Siemens" for product "Scalance W1750d Firmware" | * | - |
Affected
| in | Siemens Search vendor "Siemens" | Scalance W1750d Search vendor "Siemens" for product "Scalance W1750d" | - | - |
Safe
|
| Arubanetworks Search vendor "Arubanetworks" | Arubaos Search vendor "Arubanetworks" for product "Arubaos" | >= 10.3.0.0 < 10.3.1.1 Search vendor "Arubanetworks" for product "Arubaos" and version " >= 10.3.0.0 < 10.3.1.1" | - |
Affected
| ||||||
| Arubanetworks Search vendor "Arubanetworks" | Instant Search vendor "Arubanetworks" for product "Instant" | >= 6.4.0.0 < 6.4.4.8-4.2.4.21 Search vendor "Arubanetworks" for product "Instant" and version " >= 6.4.0.0 < 6.4.4.8-4.2.4.21" | - |
Affected
| ||||||
| Arubanetworks Search vendor "Arubanetworks" | Instant Search vendor "Arubanetworks" for product "Instant" | >= 6.5.0.0 < 6.5.4.24 Search vendor "Arubanetworks" for product "Instant" and version " >= 6.5.0.0 < 6.5.4.24" | - |
Affected
| ||||||
| Arubanetworks Search vendor "Arubanetworks" | Instant Search vendor "Arubanetworks" for product "Instant" | >= 8.6.0.0 < 8.6.0.19 Search vendor "Arubanetworks" for product "Instant" and version " >= 8.6.0.0 < 8.6.0.19" | - |
Affected
| ||||||
| Arubanetworks Search vendor "Arubanetworks" | Instant Search vendor "Arubanetworks" for product "Instant" | >= 8.7.0.0 < 8.7.1.10 Search vendor "Arubanetworks" for product "Instant" and version " >= 8.7.0.0 < 8.7.1.10" | - |
Affected
| ||||||
| Arubanetworks Search vendor "Arubanetworks" | Instant Search vendor "Arubanetworks" for product "Instant" | >= 8.10.0.0 < 8.10.0.2 Search vendor "Arubanetworks" for product "Instant" and version " >= 8.10.0.0 < 8.10.0.2" | - |
Affected
| ||||||