CVE-2022-37907

published 2022-12-12

CVE-2022-37907: A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A…

Priority P3 37 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A successful attacker can cause a system hang which can only be resolved via a power cycle of the impacted controller.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
arubanetworks	arubaos	>= 6.5.4.0 < 6.5.4.22	6.5.4.22
arubanetworks	arubaos	>= 8.4.0.0 < 8.6.0.17	8.6.0.17
arubanetworks	arubaos	>= 8.7.0.0 < 8.7.1.9	8.7.1.9
arubanetworks	arubaos	>= 8.8.0.0 < 10.3.0.1	10.3.0.1
arubanetworks	sd-wan	>= 8.7.0.0-2.3.0.0 < 8.7.0.0-2.3.0.6	8.7.0.0-2.3.0.6

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-400