CVE-2021-25141
Medium
Description
A security vulnerability has been identified in in certain HPE and Aruba L2/L3 switch firmware. A data processing error due to improper handling of an unexpected data type in user supplied information to the switch's management interface has been identified. The data processing error could be exploited to cause a crash or reboot in the switch management interface and/or possibly the switch itself leading to local denial of service (DoS). The user must have administrator privileges to exploit this vulnerability.
SeverityMedium
CVSS4.4
Exploit probability—
ProductArubanetworks Aruba 5406r Zl2 Firmware
PublishedFeb 9, 2021
First seenFeb 9, 2021
How to fix
Update
- arubanetworks aruba_5406r_zl2_firmwarekb.16.10.0012 or later
- arubanetworks aruba_5412r_zl2_firmwarekb.16.10.0012 or later
- arubanetworks aruba_3810m_firmwarekb.16.10.0012 or later
- arubanetworks aruba_2930m_firmwarewc.16.10.0012 or later
- arubanetworks aruba_2930f_firmwarewc.16.10.0012 or later
- arubanetworks aruba_2920_firmwarewb.16.10.0011 or later
- arubanetworks aruba_2540_firmwareyc.16.10.0012 or later
- arubanetworks aruba_2530ya_firmwareya.16.10.0012 or later
- arubanetworks aruba_3800_firmwareka.16.04.0022 or later
- arubanetworks aruba_2620_firmwarera.16.04.0022 or later
- hpe 8200_zl_firmwarek.15.18.0024 or later
- hpe 6200_yl_firmwarek.15.18.0024 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| arubanetworks aruba_5406r_zl2_firmware | v < kb.16.10.0012 | kb.16.10.0012 |
| arubanetworks aruba_5412r_zl2_firmware | v < kb.16.10.0012 | kb.16.10.0012 |
| arubanetworks aruba_3810m_firmware | v < kb.16.10.0012 | kb.16.10.0012 |
| arubanetworks aruba_2930m_firmware | v < wc.16.10.0012 | wc.16.10.0012 |
| arubanetworks aruba_2930f_firmware | v < wc.16.10.0012 | wc.16.10.0012 |
| arubanetworks aruba_2920_firmware | v < wb.16.10.0011 | wb.16.10.0011 |
| arubanetworks aruba_2540_firmware | v < yc.16.10.0012 | yc.16.10.0012 |
| arubanetworks aruba_2530ya_firmware | v < ya.16.10.0012 | ya.16.10.0012 |
| arubanetworks aruba_3800_firmware | v < ka.16.04.0022 | ka.16.04.0022 |
| arubanetworks aruba_2620_firmware | v < ra.16.04.0022 | ra.16.04.0022 |
| hpe 8200_zl_firmware | v < k.15.18.0024 | k.15.18.0024 |
| hpe 6200_yl_firmware | v < k.15.18.0024 | k.15.18.0024 |
| hpe 3500_firmware | v < k.16.02.0032 | k.16.02.0032 |
| hpe 3500_yl_firmware | v < k.16.02.0032 | k.16.02.0032 |
| arubanetworks aruba_2530yb_firmware | v < yb.16.10.0012 | yb.16.10.0012 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.