CRITICAL
Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS Processes
Published Feb 28, 2023
9.8
CRITICALCVSS 3.1
EPSS 1.07%
Description
There are buffer overflow vulnerabilities in multiple underlying operating system processes that could lead to unauthenticated remote code execution by sending specially crafted packets via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Affected products
-
- Version ArubaOS 10.3.x.x: 10.3.1.0 and belowStatusaffectedConstraints-
- Version ArubaOS 8.10.x.x: 8.10.0.4 and belowStatusaffectedConstraints-
- Version SD-WAN 8.7.0.0-2.3.0.x: 8.7.0.0-2.3.0.8 and belowStatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | n/a | affected |
|
OR
- ≥ 8.7.0.0-2.3.0.0 · ≤ 8.7.0.0-2.3.0.8
- ≥ 8.6.0.0 · ≤ 8.6.0.19
- ≥ 8.10.0.0 · ≤ 8.10.0.4
- ≥ 10.3.0.0 · ≤ 10.3.1.0
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-26872 Advisory
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt Vendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-26872 | Advisory | |
| https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-002.txt | Vendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner hpe
Published Feb 28, 2023
Updated Mar 7, 2025
Reserved Jan 6, 2023
Link CVE-2023-22754
CISA Vulnrichment
Updated Mar 7, 2025
ENISA EUVD
EUVD-2023-26872 Assigner hpe
Published Feb 28, 2023
Updated Mar 7, 2025
Exploited since n/a
Link EUVD-2023-26872