CVE-2023-45626 — Incorrect Authorization in Arubaos

CWE-863 — Incorrect Authorization3 documents3 sources
Severity
7.2HIGHNVD
CNA5.5
EPSS
0.0%
top 86.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Arubanetworks ArubaosHP Instantos
Timeline
PublishedNov 14
Latest updateNov 15

Description

An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across boot cycles.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDhp/instantos6.4.0.0 — 8.6.0.23+2
▶NVDarubanetworks/arubaos10.3.0.0 — 10.4.0.3+1

🔴Vulnerability Details

2
GHSA
GHSA-49p4-5fq3-8pq9: An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution↗2023-11-15
▶
CVEList
CVE-2023-45626: An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution↗2023-11-14
▶