Arubanetworks Arubaos vulnerabilities

CVE-2024-33515 [HIGH] CWE-121 CVE-2024-33515: Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected service.

CVE-2024-33516 [HIGH] CWE-121 CVE-2024-33516: An unauthenticated Denial of Service (DoS) vulnerability exists in the Auth service accessed via the An unauthenticated Denial of Service (DoS) vulnerability exists in the Auth service accessed via the PAPI protocol provided by ArubaOS. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the controller.

CVE-2024-31480 [HIGH] CWE-78 CVE-2024-31480: Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PA Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.

CVE-2024-31479 [HIGH] CWE-78 CVE-2024-31479: Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.

CVE-2024-31481 [HIGH] CWE-78 CVE-2024-31481: Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PA Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.

CVE-2026-23809 [HIGH] CWE-400 CVE-2026-23809: A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs. By leveraging the relationship between BSSIDs and their associated virtual ports, an attacker could potentially bypass inter-BSSID isolation controls. Successful exploitation may enable an attacker to redirect and intercept the victi

CVE-2025-37136 [MEDIUM] CWE-284 CVE-2025-37136: Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.

CVE-2025-37137 [MEDIUM] CWE-284 CVE-2025-37137: Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.

CVE-2025-37135 [MEDIUM] CWE-284 CVE-2025-37135: Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.

CVE-2024-33517 [HIGH] CWE-121 CVE-2024-33517: An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager servi An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service.

CVE-2022-37907 [HIGH] CWE-400 CVE-2022-37907: A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a de A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A successful attacker can cause a system hang which can only be resolved via a power cycle of the impacted controller.

CVE-2023-22773 [MEDIUM] CWE-22 CVE-2023-22773: Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.

CVE-2023-22774 [MEDIUM] CWE-22 CVE-2023-22774: Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.

CVE-2023-22772 [MEDIUM] CWE-22 CVE-2023-22772: An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface. An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to delete arbitrary files in the underlying operating system.

CVE-2024-31483 [MEDIUM] CVE-2024-31483: An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed v An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system.

CVE-2023-22777 [MEDIUM] CWE-668 CVE-2023-22777: An authenticated information disclosure vulnerability exists in the ArubaOS web-based management int An authenticated information disclosure vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system.

CVE-2021-37725 [HIGH] CWE-352 CVE-2021-37725: A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba SD-WAN Software and A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.8.0.1, 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.15. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerabili

CVE-2023-22775 [MEDIUM] CWE-668 CVE-2023-22775: A vulnerability exists which allows an authenticated attacker to access sensitive information on the A vulnerability exists which allows an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation could allow access to data beyond what is authorized by the users existing privilege level.

CVE-2008-7095 [HIGH] CWE-264 CVE-2008-7095: The SNMP daemon in ArubaOS 3.3.2.6 in Aruba Mobility Controller does not restrict SNMP access, which The SNMP daemon in ArubaOS 3.3.2.6 in Aruba Mobility Controller does not restrict SNMP access, which allows remote attackers to (1) read all SNMP community strings via SNMP-COMMUNITY-MIB::snmpCommunityName (1.3.6.1.6.3.18.1.1.1.2) or SNMP-VIEW-BASED-ACM-MIB::vacmGroupName (1.3.6.1.6.3.16.1.2.1.3) with knowledge of one community string, and (2) read SNMP

CVE-2023-35976 [MEDIUM] CVE-2023-35976: Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the A Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation could allow access to data beyond what is authorized by the users existing privilege level.