Arubanetworks Arubaos vulnerabilities

CVE-2026-44860 [HIGH] CWE-89 CVE-2026-44860: SQL injection vulnerabilities exist in several underlying service components accessible through the SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database querie

CVE-2026-44861 [HIGH] CWE-89 CVE-2026-44861: SQL injection vulnerabilities exist in several underlying service components accessible through the SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database querie

CVE-2022-37903 [HIGH] CWE-787 CVE-2022-37903: A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with att A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface. Successful exploitation of this vulnerability could lead to full compromise the underlying host operating system.

CVE-2024-25614 [CRITICAL] CWE-22 CVE-2024-25614: There is an arbitrary file deletion vulnerability in the CLI used by ArubaOS. Successful exploitatio There is an arbitrary file deletion vulnerability in the CLI used by ArubaOS. Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to denial-of-service conditions and impact the integrity of the controller.

CVE-2023-45618 [HIGH] CVE-2023-45618: There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Ar There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity

CVE-2023-45625 [HIGH] CWE-77 CVE-2023-45625: Multiple authenticated command injection vulnerabilities exist in the command line interface. Succes Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVE-2023-22761 [HIGH] CWE-77 CVE-2023-22761: Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management int Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the devic

CVE-2023-22760 [HIGH] CWE-77 CVE-2023-22760: Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management int Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the devic

CVE-2023-22758 [HIGH] CWE-77 CVE-2023-22758: Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management int Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the devic

CVE-2023-22759 [HIGH] CWE-77 CVE-2023-22759: Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management int Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the devic

CVE-2023-45617 [HIGH] CVE-2023-45617: There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's acces There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the acce

CVE-2023-45619 [HIGH] CVE-2023-45619: There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's acce There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the acces

CVE-2024-31475 [HIGH] CWE-463 CVE-2024-31475: There is an arbitrary file deletion vulnerability in the Central Communications service accessed by There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact t

CVE-2024-31474 [HIGH] CWE-463 CVE-2024-31474: There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Acces There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of th

CVE-2022-37900 [HIGH] CWE-78 CVE-2022-37900: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Success Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVE-2022-37899 [HIGH] CWE-78 CVE-2022-37899: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Success Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVE-2022-37902 [HIGH] CWE-78 CVE-2022-37902: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Success Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVE-2022-37901 [HIGH] CWE-78 CVE-2022-37901: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Success Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVE-2025-37176 [HIGH] CWE-77 CVE-2025-37176: A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a packag A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. Successful exploit could allow an authenticated malicious actor to execute commands with the privileges of the impacted mechanism.

CVE-2025-27082 [HIGH] CWE-434 CVE-2025-27082: Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlying host operating system.