CVE-2022-37914
Critical
Description
Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to bypass authentication. Successful exploitation of these vulnerabilities could allow an attacker to gain administrative privileges leading to a complete compromise of the Aruba EdgeConnect Enterprise Orchestrator with versions 9.1.2.40051 and below, 9.0.7.40108 and below, 8.10.23.40009 and below, and any older branches of Orchestrator not specifically mentioned.
SeverityCritical
CVSS9.8
Exploit probability—
ProductArubanetworks Aruba Edgeconnect Enterprise Orchestrator
PublishedOct 28, 2022
First seenOct 28, 2022
Weakness typeCWE-287Improper authentication
How to fix
Update
- arubanetworks aruba_edgeconnect_enterprise_orchestrator8.10.23.40009, 9.0.7.40108, 9.1.3.40197 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| arubanetworks aruba_edgeconnect_enterprise_orchestrator | v < 8.10.23.40009, 9.0.0 ≤ v < 9.0.7.40108, 9.1.0 ≤ v < 9.1.3.40197 | 8.10.23.40009, 9.0.7.40108, 9.1.3.40197 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.