CVE-2022-37905

EPSS 0.78%
Veröffentlicht 12.12.2022 13:15:12
Zuletzt bearbeitet 02.05.2025 19:15:51
Erkennungen
Login

Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 6 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Arubanetworks ≫ Sd-wan Version >= 8.7.0.0-2.3.0.0 < 8.7.0.0-2.3.0.6

   Arubanetworks ≫ 7005 Version -
   Arubanetworks ≫ 7008 Version -
   Arubanetworks ≫ 7010 Version -
   Arubanetworks ≫ 7024 Version -
   Arubanetworks ≫ 7030 Version -
   Arubanetworks ≫ 7205 Version -
   Arubanetworks ≫ 7210 Version -
   Arubanetworks ≫ 7220 Version -
   Arubanetworks ≫ 7240xm Version -
   Arubanetworks ≫ 7280 Version -

Arubanetworks ≫ Arubaos Version >= 6.5.4.0 < 6.5.4.22

Arubanetworks ≫ Arubaos Version >= 8.4.0.0 < 8.6.0.17

Arubanetworks ≫ Arubaos Version >= 8.7.0.0 < 8.7.1.9

Arubanetworks ≫ Arubaos Version >= 8.8.0.0 <= 8.9.0.3

Arubanetworks ≫ Arubaos Version 10.3.0.0

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.78%	0.527

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
HPE	6.6	0.7	5.9	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-1236 Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2022-37905

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-37905

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-37905

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2022-37905