CVE-2008-7095 — Arubaos vulnerability

CWE-2643 documents3 sources

Severity

7.8HIGHNVD

EPSS

0.3%

top 46.29%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Arubanetworks Arubaos

Timeline

PublishedAug 27

Latest updateMay 14

Description

The SNMP daemon in ArubaOS 3.3.2.6 in Aruba Mobility Controller does not restrict SNMP access, which allows remote attackers to (1) read all SNMP community strings via SNMP-COMMUNITY-MIB::snmpCommunityName (1.3.6.1.6.3.18.1.1.1.2) or SNMP-VIEW-BASED-ACM-MIB::vacmGroupName (1.3.6.1.6.3.16.1.2.1.3) with knowledge of one community string, and (2) read SNMPv3 user names via SNMP-USER-BASED-SM-MIB or SNMP-VIEW-BASED-ACM-MIB.

CVSS vector

AV:N/AC:L/C:C/I:N/A:NExploitability: 10.0 | Impact: 6.9

Affected Packages1 packages

▶NVDarubanetworks/arubaos3.3.2.6

🔴Vulnerability Details

GHSA

GHSA-gv7w-55hp-ch9m: The SNMP daemon in ArubaOS 3↗2022-05-14

▶

CVEList

CVE-2008-7095: The SNMP daemon in ArubaOS 3↗2009-08-27

▶