CVE-2023-22750

Multiple Unauthenticated Command Injections in the PAPI Protocol

Critical · published February 28, 2023

CVSS v3.1
9.8
EPSS
2%
Percentile
77.5
In the wild
Unconfirmed
What it is

🚨 Just a few crafty packets sent to UDP port 8211 can give attackers the keys to your kingdom! 🔥 Think of this vulnerability like a delivery service that will drop off highly sensitive packages without checking the address. A rogue delivery person could send a package straight to your most important files without even needing to knock! An attacker could exploit this command injection flaw to execute arbitrary code with privileged access on the operating system. This leaves your entire network wide open to manipulation, data breaches, and potentially catastrophic consequences.

Put simply

Think of this vulnerability like a delivery service that will drop off highly sensitive packages without checking the address. A rogue delivery person could send a package straight to your most important files without even needing to knock! Multiple command injection vulnerabilities in Aruba Networks' PAPI allow unauthenticated remote code execution by sending specially crafted packets to UDP port 8211, giving attackers control of the underlying system.

What to do

An attacker could exploit this command injection flaw to execute arbitrary code with privileged access on the operating system. This leaves your entire network wide open to manipulation, data breaches, and potentially catastrophic consequences. To mitigate this, immediately block UDP port 8211 on your firewall, apply the latest firmware updates from Aruba Networks, and conduct a full security audit of your network. Don't let those packets slip through! You've got this! By taking immediate action, you can secure your network and keep those delivery threats at bay! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01740 · 77.5th percentile
Published
2023-02-28T16:09Z
EPSS history
Timeline
  • 28 FEB 16:09Z
    Multiple Unauthenticated Command Injections in the PAPI Protocol
    cvelistv5