Arubanetworks Arubaos vulnerabilities

CVE-2025-37173 [HIGH] CWE-20 CVE-2025-37173: An improper input handling vulnerability exists in the web-based management interface of mobility co An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor with valid credentials to trigger unintended behavior on the affected system.

CVE-2015-1388 [HIGH] CWE-78 CVE-2015-1388: The "RAP console" feature in ArubaOS 5.x through 6.2.x, 6.3.x before 6.3.1.15, and 6.4.x before 6.4. The "RAP console" feature in ArubaOS 5.x through 6.2.x, 6.3.x before 6.3.1.15, and 6.4.x before 6.4.2.4 on Aruba access points in Remote Access Point (AP) mode allows remote attackers to execute arbitrary commands via unspecified vectors.

CVE-2020-24637 [HIGH] CVE-2020-24637: Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Suc Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerability this could lead to remote compromise of system integrity by allowing an attacker to load an untrusted or modified kernel in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Control

CVE-2023-45626 [HIGH] CWE-863 CVE-2023-45626: An authenticated vulnerability has been identified allowing an attacker to effectively establish hig An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across boot cycles.

CVE-2024-31478 [HIGH] CWE-78 CVE-2024-31478: Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon access Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilites result in the ability to interrupt the normal operation of the affected Access Point.

CVE-2025-37161 [HIGH] CWE-400 CVE-2025-37161: A vulnerability in the web-based management interface of affected products could allow an unauthenti A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.

CVE-2025-37177 [MEDIUM] CWE-552 CVE-2025-37177: An arbitrary file deletion vulnerability has been identified in the command-line interface of mobili An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation of this vulnerability could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.

CVE-2014-7299 [HIGH] CVE-2014-7299: Unspecified vulnerability in administrative interfaces in ArubaOS 6.3.1.11, 6.3.1.11-FIPS, 6.4.2.1, Unspecified vulnerability in administrative interfaces in ArubaOS 6.3.1.11, 6.3.1.11-FIPS, 6.4.2.1, and 6.4.2.1-FIPS on Aruba controllers allows remote attackers to bypass authentication, and obtain potentially sensitive information or add guest accounts, via an SSH session.

CVE-2023-45624 [HIGH] CVE-2023-45624: An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via t An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.

CVE-2023-45620 [HIGH] CVE-2023-45620: Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PA Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

CVE-2023-45621 [HIGH] CWE-400 CVE-2023-45621: Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PA Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

CVE-2023-45622 [HIGH] CWE-400 CVE-2023-45622: Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

CVE-2023-45623 [HIGH] CVE-2023-45623: Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed v Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.

CVE-2024-31482 [HIGH] CWE-78 CVE-2024-31482: An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service acce An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected Access Point.

CVE-2025-37178 [HIGH] CWE-125 CVE-2025-37178: Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for ha Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. Under specific conditions, this can result in a crash of the affected process and a potential d

CVE-2008-2273 [CRITICAL] CVE-2008-2273: Unspecified vulnerability in the TACACS authentication component in Aruba Mobility Controller 3.1.x, Unspecified vulnerability in the TACACS authentication component in Aruba Mobility Controller 3.1.x, 3.2.x, and 3.3.x allows remote authenticated users to gain privileges via unknown vectors.

CVE-2023-22787 [HIGH] CVE-2023-22787: An unauthenticated Denial of Service (DoS) vulnerability exists in a service accessed via the PAPI p An unauthenticated Denial of Service (DoS) vulnerability exists in a service accessed via the PAPI protocol provided by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.

CVE-2018-7080 [HIGH] CVE-2018-7080: A vulnerability exists in the firmware of embedded BLE radios that are part of some Aruba Access poi A vulnerability exists in the firmware of embedded BLE radios that are part of some Aruba Access points. An attacker who is able to exploit the vulnerability could install new, potentially malicious firmware into the AP's BLE radio and could then gain access to the AP's console port. This vulnerability is applicable only if the BLE radio has been enabled in aff

CVE-2023-35979 [HIGH] CWE-120 CVE-2023-35979: There is an unauthenticated buffer overflow vulnerability in the process controlling the ArubaOS web There is an unauthenticated buffer overflow vulnerability in the process controlling the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in a Denial-of-Service (DoS) condition affecting the web-based management interface of the controller.

CVE-2024-33514 [HIGH] CWE-121 CVE-2024-33514: Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected service.