HPE Arubaos-cx

ArubaOS-CX Platform-Level Denial-of-Service Vulnerability

Authorization Bypass in the API Endpoint of AOS-CX Leads to Unauthorized Access

Authenticated Path Traversal Vulnerability Leads to Remote Unauthorized Access to Files in AOS-CX

Authenticated Privilege Escalation Vulnerability via Broken Access Control in AOS-CX

Unauthenticated Denial-of-Service Vulnerabilities in AOS-CX

Unauthenticated Buffer Overflow Vulnerabilities lead to Denial-of-Service in AOS-CX

Unauthenticated Open Redirect allows URL Manipulation in Web Interface

Authenticated Broken Access Control (BAC) in REST API Configuration Service

Unauthenticated Out-of-Bounds Read Vulnerability leads to Information Disclosure in AOS-CX

Authenticated Server-Side Request Forgery (SSRF) Leading to Information Disclosure in AOS-CX

Multiple unauthenticated command injection vulnerabilities were discovered in the AOS-CX API interface in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): AOS-CX 10.06.xxxx: 10.06.0170 and below, AOS-CX 10.07.xxxx: 10.07.0050 and below, AOS-CX 10.08.xxxx: 10.08.1030 and below, AOS-CX 10.09.xxxx: 10.09.0002 and below. Aruba has released upgrades for Aruba AOS-CX devices that address these security vulnerabilities.

Unauthenticated Sensitive Information Disclosure via Man-in-the-Middle in AOS-CX via API Endpoint

Privilege Escalation via Unauthorized Access to Sensitive Session Information

Authenticated Denial-of-Service Vulnerabilities in the Command Line Interface of AOS-CX

Authenticated Stack Overflow Vulnerabilities lead to Denial-of-Service in AOS-CX

Unauthenticated Traffic Handling Flaw Allows Packet Leakage on HPE Aruba Networking CX 10000 series switches

Failure to Properly Enforce Port ACLs on CPU generated packets in CX 9300 Switches