Arubanetworks Arubaos vulnerabilities

CVE-2021-37720 [HIGH] CWE-77 CVE-2021-37720: A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gatew A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnera

CVE-2021-37721 [HIGH] CWE-77 CVE-2021-37721: A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gatew A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnera

CVE-2021-37722 [HIGH] CWE-77 CVE-2021-37722: A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gatew A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnera

CVE-2021-37719 [HIGH] CWE-77 CVE-2021-37719: A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gatew A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnera

CVE-2022-37898 [HIGH] CWE-78 CVE-2022-37898: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Success Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVE-2026-23826 [HIGH] CWE-770 CVE-2026-23826: A vulnerability in a network management service of AOS-8 Operating System could allow an unauthentic A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to the affected device, potentially resulting in a denial-of-service condition. Successful exploitation could cause the affected service process to terminate

CVE-2023-35974 [HIGH] CWE-77 CVE-2023-35974: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Success Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVE-2023-35973 [HIGH] CWE-77 CVE-2023-35973: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Success Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVE-2026-23824 [HIGH] CWE-400 CVE-2026-23824: Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An una Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial

CVE-2026-23825 [HIGH] CWE-20 CVE-2026-23825: Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An una Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-

CVE-2021-37723 [HIGH] CWE-77 CVE-2021-37723: A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16. Aruba has released patches for ArubaOS that address this security vulnerability.

CVE-2021-37724 [HIGH] CWE-77 CVE-2021-37724: A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16. Aruba has released patches for ArubaOS that address this security vulnerability.

CVE-2026-23808 [HIGH] CWE-94 CVE-2026-23808: A vulnerability has been identified in a standardized wireless roaming protocol that could enable a A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to install an attacker-controlled Group Temporal Key (GTK) on a client device. Successful exploitation of this vulnerability could allow a remote malicious actor to perform unauthorized frame injection, bypass client isolation, interfere w

CVE-2019-5315 [HIGH] CWE-78 CVE-2019-5315: A command injection vulnerability is present in the web management interface of ArubaOS that permits A command injection vulnerability is present in the web management interface of ArubaOS that permits an authenticated user to execute arbitrary commands on the underlying operating system. A malicious administrator could use this ability to install backdoors or change system configuration in a way that would not be logged. This vulnerability only affects

CVE-2025-37173 [HIGH] CWE-20 CVE-2025-37173: An improper input handling vulnerability exists in the web-based management interface of mobility co An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor with valid credentials to trigger unintended behavior on the affected system.

CVE-2022-37893 [HIGH] CWE-78 CVE-2022-37893: An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 comman An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.

CVE-2015-1388 [HIGH] CWE-78 CVE-2015-1388: The "RAP console" feature in ArubaOS 5.x through 6.2.x, 6.3.x before 6.3.1.15, and 6.4.x before 6.4. The "RAP console" feature in ArubaOS 5.x through 6.2.x, 6.3.x before 6.3.1.15, and 6.4.x before 6.4.2.4 on Aruba access points in Remote Access Point (AP) mode allows remote attackers to execute arbitrary commands via unspecified vectors.

CVE-2023-45626 [HIGH] CWE-863 CVE-2023-45626: An authenticated vulnerability has been identified allowing an attacker to effectively establish hig An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across boot cycles.

CVE-2025-37161 [HIGH] CWE-400 CVE-2025-37161: A vulnerability in the web-based management interface of affected products could allow an unauthenti A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.

CVE-2020-24637 [HIGH] CVE-2020-24637: Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Suc Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerability this could lead to remote compromise of system integrity by allowing an attacker to load an untrusted or modified kernel in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Control