CVE-2022-23676

published 2022-05-10

CVE-2022-23676: A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch…

Priority P2 73 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch 16.03.xxxx: All versions; ArubaOS-Switch 16.04.xxxx: All versions; ArubaOS-Switch 16.05.xxxx: All versions; ArubaOS-Switch 16.06.xxxx: All versions; ArubaOS-Switch 16.07.xxxx: All versions; ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0024 and below; ArubaOS-Switch 16.09.xxxx: KB/WB/WC/YA/YB/YC.16.09.0019 and below; ArubaOS-Switch 16.10.xxxx: KB/WB/WC/YA/YB/YC.16.10.0019 and below; ArubaOS-Switch 16.11.xxxx: KB/WB/WC/YA/YB/YC.16.11.0003 and below. Aruba has released upgrades for ArubaOS-Switch Devices that address these security vulnerabilities.

Affected

77 ranges · showing 25

Vendor	Product	Version range	Fixed in
arubanetworks	2530_firmware	15.00.0 – 15.16.0023	—
arubanetworks	2530_firmware	>= 16.01.0 < 16.02.0034	16.02.0034
arubanetworks	2530_firmware	16.03.0 – 16.04.0024	—
arubanetworks	2530_firmware	>= 16.05.0 < 16.08.0025	16.08.0025
arubanetworks	2530_firmware	>= 16.09.0 < 16.09.0020	16.09.0020
arubanetworks	2530_firmware	>= 16.10.0 < 16.10.0020	16.10.0020
arubanetworks	2530_firmware	>= 16.11.0 < 16.11.0004	16.11.0004
arubanetworks	2540_firmware	15.00.0 – 15.16.0023	—
arubanetworks	2540_firmware	>= 16.01.0 < 16.02.0034	16.02.0034
arubanetworks	2540_firmware	16.03.0 – 16.04.0024	—
arubanetworks	2540_firmware	>= 16.05.0 < 16.08.0025	16.08.0025
arubanetworks	2540_firmware	>= 16.09.0 < 16.09.0020	16.09.0020
arubanetworks	2540_firmware	>= 16.10.0 < 16.10.0020	16.10.0020
arubanetworks	2540_firmware	>= 16.11.0 < 16.11.0004	16.11.0004
arubanetworks	2615_firmware	15.00.0 – 15.16.0023	—
arubanetworks	2615_firmware	>= 16.01.0 < 16.02.0034	16.02.0034
arubanetworks	2615_firmware	16.03.0 – 16.04.0024	—
arubanetworks	2615_firmware	>= 16.05.0 < 16.08.0025	16.08.0025
arubanetworks	2615_firmware	>= 16.09.0 < 16.09.0020	16.09.0020
arubanetworks	2615_firmware	>= 16.10.0 < 16.10.0020	16.10.0020
arubanetworks	2615_firmware	>= 16.11.0 < 16.11.0004	16.11.0004
arubanetworks	2620_firmware	15.00.0 – 15.16.0023	—
arubanetworks	2620_firmware	>= 16.01.0 < 16.02.0034	16.02.0034
arubanetworks	2620_firmware	16.03.0 – 16.04.0024	—
arubanetworks	2620_firmware	>= 16.05.0 < 16.08.0025	16.08.0025

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.3 CRITICAL AV:N/AC:M/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-787