HPE Arubaos-cx

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX

Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset

Credential Manager Vulnerability Allows Unauthorized Administrative Access

An authenticated remote code execution vulnerability was discovered in the AOS-CX Network Analytics Engine (NAE) in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): AOS-CX 10.07.xxxx: 10.07.0050 and below, AOS-CX 10.08.xxxx: 10.08.1030 and below, AOS-CX 10.09.xxxx: 10.09.0002 and below. Aruba has released upgrades for Aruba AOS-CX devices that address this security vulnerability.

Multiple authenticated remote code execution vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): AOS-CX 10.06.xxxx: 10.06.0170 and below, AOS-CX 10.07.xxxx: 10.07.0050 and below, AOS-CX 10.08.xxxx: 10.08.1030 and below. Aruba has released upgrades for Aruba AOS-CX devices that address these security vulnerabilities.

Authenticated Command Injection Vulnerability in AOS-CX Command Line Interface

Authenticated Command Injection found in admin AOS-CX CLI command

Authenticated Remote Code Execution in Aruba CX Switches

Authenticated Buffer Overflow Vulnerabilities in AOS-CX API Endpoint Leads to Possible Code Execution

Low-Privilege Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX

Authenticated Remote Command Injection in AOS-CX Web-based Management Interface

Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface

Authenticated Command Injection allows Unauthorized Command Execution in AOS-CX

Authenticated Command Injection allows Unauthorized Command Execution in AOS-CX

Authenticated Command Injection found in AOS-CX CLI Command

Unauthenticated Remote Command Execution in Management Component

Unauthenticated Arbitrary File Write Vulnerability Leads to Remote Code Execution in AOS-CX

Unauthenticated Format String Vulnerability leads to Remote Code Execution in AOS-CX

Multiple authenticated remote path traversal vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): AOS-CX 10.06.xxxx: 10.06.0170 and below, AOS-CX 10.07.xxxx: 10.07.0050 and below, AOS-CX 10.08.xxxx: 10.08.1030 and below, AOS-CX 10.09.xxxx: 10.09.0002 and below. Aruba has released upgrades for Aruba AOS-CX devices that address these security vulnerabilities.

Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in AOS-CX Web-Based Management Interface

Lack of Cross-Site Request Forgery (CSRF) Protections for Certificate-Authenticated Sessions in AOS-CX

Authentication Bypass Vulnerabilities Leading to Information Disclosure, Unauthorized Modification, and Service Disruption in AOS-CX

Authorization Bypass Vulnerabilities Leading to Privilege Escalation in AOS-CX API Endpoint

Authenticated Signature Verification Bypass Leading to Arbitrary Code Execution in AOS-CX

Authenticated Privilege Escalation Allows Unauthorized Access in Network Management Interface

Authenticated Sensitive Information Disclosure Vulnerabilities in AOS-CX

Unauthenticated Buffer Overflow Vulnerability leads to Sensitive Information Disclosure in AOS-CX

The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.

Improper Authentication Handling in AOS-CX Management Interface and API

Unauthenticated Denial-of-Service (DoS) Vulnerability in AOS-CX

Authenticated Session Hijacking Allows Unauthorized Access in Network Switching Software

Authenticated Arbitrary File Write Vulnerability Leading to Remote Code Execution in AOS-CX

Local Privilege Escalation in AOS-CX Command Line Interface

Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface

Authenticated Command Injection Vulnerabilities in the API Endpoint of AOS-CX

Authenticated Command Injection found in AOS-CX Administrative CLI Command

Authenticated Path Traversal Vulnerabilities Lead to Remote Code Execution in AOS-CX

Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in AOS-CX

Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX

Authentication Bypass Vulnerabilities Leading to Unauthorized Modification and Service Disruption in AOS-CX