CVE-2023-22752 - Unauthenticated Stack-Based Buffer Overflow Vulnerabilities in the PAPI Protocol

Back Back to CVE browser

CRITICAL

Unauthenticated Stack-Based Buffer Overflow Vulnerabilities in the PAPI Protocol

Published Feb 28, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 1.30%

Description

There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

Affected products

Vendor Hewlett Packard Enterprise (HPE) Product n/a Default
affected
- Version
  ArubaOS 10.3.x.x: 10.3.1.0 and below
  Status
  affected
  Constraints
  -
- Version
  ArubaOS 8.10.x.x: 8.10.0.4 and below
  Status
  affected
  Constraints
  -
- Version
  ArubaOS 8.6.x.x: 8.6.0.19 and below
  Status
  affected
  Constraints
  -
- Version
  SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Hewlett Packard Enterprise (HPE)

n/a

affected

Version	Status	Constraints
ArubaOS 10.3.x.x: 10.3.1.0 and below	affected	-
ArubaOS 8.10.x.x: 8.10.0.4 and below	affected	-
ArubaOS 8.6.x.x: 8.6.0.19 and below	affected	-
SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and below	affected	-