CVE-2022-37905CWE-1236

CVE-2022-37905

Medium · published December 12, 2022

CVSS v3.1
6.6
EPSS
1%
Percentile
56.9
In the wild
Unconfirmed
What it is

Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00823 · 56.9th percentile
Weakness
CWE-1236 · Improper Neutralization of Formula Elements in a CSV File
Published
2022-12-12T18:15Z
Affected products (6)
ProductVersionsFixed in
arubanetworks/sd-wan≥ 8.5.0.0-2.1.0.0, < 8.7.0.0-2.3.0.78.7.0.0-2.3.0.7
arubanetworks/arubaos≥ 6.5.4.0, < 6.5.4.236.5.4.23
arubanetworks/arubaos≥ 8.4.0.0, < 8.6.0.188.6.0.18
arubanetworks/arubaos≥ 8.7.0.0, < 8.7.1.108.7.1.10
arubanetworks/arubaos≥ 8.8.0.0, < 8.10.0.08.10.0.0
arubanetworks/arubaosall versions—
References (2)
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt · [email protected]https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 03 NOV 19:15Z
    Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence
    cvelistv5