Critical · published December 12, 2022
🚨 A command injection vulnerability lets attackers execute arbitrary code remotely, all thanks to some specially crafted packets sent to an unwatched UDP port! 🔥 Think of it like a delivery person dropping off a package without checking what's inside. If left unchecked, they might deliver a bomb instead of the new office supplies you ordered! An attacker could gain privileged access to the underlying operating system, allowing them to install malware, steal sensitive data, and wreak havoc like a mischievous ghost in your network. The consequences could be absolutely devastating, compromising your entire infrastructure!
Think of it like a delivery person dropping off a package without checking what's inside. If left unchecked, they might deliver a bomb instead of the new office supplies you ordered! This vulnerability occurs in the PAPI (Aruba Networks AP management protocol) UDP port (8211), where an unauthenticated attacker can send specially crafted packets to execute arbitrary code as a privileged user.
An attacker could gain privileged access to the underlying operating system, allowing them to install malware, steal sensitive data, and wreak havoc like a mischievous ghost in your network. The consequences could be absolutely devastating, compromising your entire infrastructure! Immediately patch to version X.X.X, which addresses this critical vulnerability. Additionally, consider implementing network segmentation to limit access to sensitive services and monitor traffic for unusual activity on port 8211. You've got this! With these steps, you'll be well on your way to securing your network against this nasty exploit. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| arubanetworks/sd-wan | ≥ 8.5.0.0-2.1.0.0, < 8.7.0.0-2.3.0.7 | 8.7.0.0-2.3.0.7 |
| arubanetworks/arubaos | ≥ 6.5.4.0, < 6.5.4.23 | 6.5.4.23 |
| arubanetworks/arubaos | ≥ 8.4.0.0, < 8.6.0.18 | 8.6.0.18 |
| arubanetworks/arubaos | ≥ 8.7.0.0, < 8.7.1.10 | 8.7.1.10 |
| arubanetworks/arubaos | ≥ 8.8.0.0, < 8.10.0.0 | 8.10.0.0 |
| arubanetworks/arubaos | all versions | — |