CVE-2022-23683
Description
Authenticated command injection vulnerabilities exist in the AOS-CX Network Analytics Engine via NAE scripts. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system, leading to a complete compromise of the switch running AOS-CX in ArubaOS-CX Switches version(s): AOS-CX 10.10.xxxx: 10.10.0002 and below, AOS-CX 10.09.xxxx: 10.09.1030 and below, AOS-CX 10.08.xxxx: 10.08.1070 and below, AOS-CX 10.06.xxxx: 10.06.0210 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address these security vulnerabilities.
How to fix
- arubanetworks aos-cx10.06.0220, 10.08.1080, 10.09.1040, 10.10.1000 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| arubanetworks aos-cx | 10.06.0000 ≤ v < 10.06.0220, 10.08.0000 ≤ v < 10.08.1080, 10.09.0000 ≤ v < 10.09.1040, 10.10.0000 ≤ v < 10.10.1000 | 10.06.0220, 10.08.1080, 10.09.1040, 10.10.1000 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.