CVE-2022-37897CWE-78command-injection

CVE-2022-37897

Critical · published December 12, 2022

CVSS v3.1
9.8
EPSS
2%
Percentile
78.2
In the wild
Unconfirmed
What it is

🚨 A command injection vulnerability lets attackers execute arbitrary code remotely, all thanks to some specially crafted packets sent to an unwatched UDP port! 🔥 Think of it like a delivery person dropping off a package without checking what's inside. If left unchecked, they might deliver a bomb instead of the new office supplies you ordered! An attacker could gain privileged access to the underlying operating system, allowing them to install malware, steal sensitive data, and wreak havoc like a mischievous ghost in your network. The consequences could be absolutely devastating, compromising your entire infrastructure!

Put simply

Think of it like a delivery person dropping off a package without checking what's inside. If left unchecked, they might deliver a bomb instead of the new office supplies you ordered! This vulnerability occurs in the PAPI (Aruba Networks AP management protocol) UDP port (8211), where an unauthenticated attacker can send specially crafted packets to execute arbitrary code as a privileged user.

What to do

An attacker could gain privileged access to the underlying operating system, allowing them to install malware, steal sensitive data, and wreak havoc like a mischievous ghost in your network. The consequences could be absolutely devastating, compromising your entire infrastructure! Immediately patch to version X.X.X, which addresses this critical vulnerability. Additionally, consider implementing network segmentation to limit access to sensitive services and monitor traffic for unusual activity on port 8211. You've got this! With these steps, you'll be well on your way to securing your network against this nasty exploit. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01790 · 78.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2022-12-12T18:15Z
Affected products (6)
ProductVersionsFixed in
arubanetworks/sd-wan≥ 8.5.0.0-2.1.0.0, < 8.7.0.0-2.3.0.78.7.0.0-2.3.0.7
arubanetworks/arubaos≥ 6.5.4.0, < 6.5.4.236.5.4.23
arubanetworks/arubaos≥ 8.4.0.0, < 8.6.0.188.6.0.18
arubanetworks/arubaos≥ 8.7.0.0, < 8.7.1.108.7.1.10
arubanetworks/arubaos≥ 8.8.0.0, < 8.10.0.08.10.0.0
arubanetworks/arubaosall versions—
References (2)
EPSS history
Timeline
  • 03 NOV 18:12Z
    There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI…
    cvelistv5