CVE-2022-37905

EPSS 0.45%
Published 12.12.2022 13:15:12
Last modified 02.05.2025 19:15:51
Source security-alert@hpe.com
Teams watchlist Login
Open Login

Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Arubanetworks ≫ Sd-wan Version >= 8.7.0.0-2.3.0.0 < 8.7.0.0-2.3.0.6

   Arubanetworks ≫ 7005 Version-
   Arubanetworks ≫ 7008 Version-
   Arubanetworks ≫ 7010 Version-
   Arubanetworks ≫ 7024 Version-
   Arubanetworks ≫ 7030 Version-
   Arubanetworks ≫ 7205 Version-
   Arubanetworks ≫ 7210 Version-
   Arubanetworks ≫ 7220 Version-
   Arubanetworks ≫ 7240xm Version-
   Arubanetworks ≫ 7280 Version-

Arubanetworks ≫ Arubaos Version >= 6.5.4.0 < 6.5.4.22

Arubanetworks ≫ Arubaos Version >= 8.4.0.0 < 8.6.0.17

Arubanetworks ≫ Arubaos Version >= 8.7.0.0 < 8.7.1.9

Arubanetworks ≫ Arubaos Version >= 8.8.0.0 <= 8.9.0.3

Arubanetworks ≫ Arubaos Version10.3.0.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.45%	0.628

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security-alert@hpe.com	6.6	0.7	5.9	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-1236 Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2022-37905

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-37905

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-37905

EUVD