9.3
CVSSv2

CVE-2022-23676

Published: 10/05/2022 Updated: 25/05/2022
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 829
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Summary

A remote execution of arbitrary code vulnerability exists in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch 16.03.xxxx: All versions; ArubaOS-Switch 16.04.xxxx: All versions; ArubaOS-Switch 16.05.xxxx: All versions; ArubaOS-Switch 16.06.xxxx: All versions; ArubaOS-Switch 16.07.xxxx: All versions; ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0024 and below; ArubaOS-Switch 16.09.xxxx: KB/WB/WC/YA/YB/YC.16.09.0019 and below; ArubaOS-Switch 16.10.xxxx: KB/WB/WC/YA/YB/YC.16.10.0019 and below; ArubaOS-Switch 16.11.xxxx: KB/WB/WC/YA/YB/YC.16.11.0003 and below. Aruba has released upgrades for ArubaOS-Switch Devices that address these security vulnerabilities.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

arubanetworks 5406r_firmware

arubanetworks 3810m_firmware

arubanetworks 2920_firmware

arubanetworks 2930f_firmware

arubanetworks 2930m_firmware

arubanetworks 2530_firmware

arubanetworks 2540_firmware

arubanetworks 5412r_firmware

arubanetworks 2615_firmware

arubanetworks 2620_firmware

arubanetworks 2915_firmware

Recent Articles

Critical vulnerabilities found in 'millions of Aruba and Avaya switches'
The Register • Jessica Lyons Hardcastle • 01 Jan 1970

Topics Security Off-Prem On-Prem Software Offbeat Vendor Voice Vendor Voice Resources Airports, hospitals, hotels, and more need to deploy patches for hijack bugs

Five critical remote code execution vulnerabilities in millions Aruba and Avaya devices can be exploited by cybercriminals to take full control of network switches commonly used in airports, hospitals, and hotels, according to Armis researchers. The security firm discovered the bugs, collectively called TLStorm 2.0, and said they stem from insecurities in NanoSSL, a TLS library developed by Mocana that's used in the vulnerable network equipment. "Some of the vulnerabilities can be triggered...