Hewlett Packard Enterprise Vulnerabilities and Affected Products
Vulnerabilities associated with ArubaOS-Switch.
Products
Clear product- Intelligent Management Center (iMC) PLAT95 vulnerabilities
- Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central16 vulnerabilities
- Matrix Operating Environment15 vulnerabilities
- Aruba ClearPass Policy Manager11 vulnerabilities
- System Management Homepage for Windows and Linux9 vulnerabilities
- HPE 3PAR Service Processors7 vulnerabilities
- HPE AutoPass License Server7 vulnerabilities
- Network Automation6 vulnerabilities
- HPE CentralView Fraud Risk Management5 vulnerabilities
- HPE Intelligent Management Center (IMC)5 vulnerabilities
- Aruba ClearPass4 vulnerabilities
- HP Network Node Manager (NNMi)4 vulnerabilities
- HPE OneView4 vulnerabilities
- SiteScope4 vulnerabilities
- Version Control Repository Manager (VCRM)4 vulnerabilities
- ArubaOS-Switch3 vulnerabilities
- Data Protector3 vulnerabilities
- HP Keyview3 vulnerabilities
- HPE Aruba Networking EdgeConnect SD-WAN Orchestrator3 vulnerabilities
- HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 103 vulnerabilities
- HPE Telco Network Function Virtual Orchestrator3 vulnerabilities
- Insight Remote Support3 vulnerabilities
- Moonshot Provisioning Manager Appliance3 vulnerabilities
- Systems Insight Manager using OpenSSL3 vulnerabilities
- Aruba AirWave2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-39268MEDIUM | Memory Corruption Vulnerability in ArubaOS-SwitchA memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system. CWE-787Aug 29, 2023 | CVSS4.5v3.1 | EPSS0.728% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-39267MEDIUM | Authenticated Denial of Service Vulnerability in ArubaOS-Switch Command Line InterfaceAn authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Successful exploitation results in a Denial-of-Service (DoS) condition in the switch. Aug 29, 2023 | CVSS6.6v3.1 | EPSS0.683% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-39266HIGH | Unauthenticated Stored Cross-Site Scripting in ArubaOS-SwitchA vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface provided certain configuration options are present. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. CWE-79Aug 29, 2023 | CVSS8.3v3.1 | EPSS0.418% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |