CVE-2022-23691

A vulnerability exists in certain AOS-CX switch models which could allow an attacker with access to the recovery console to bypass normal authentication. A successful exploit allows an attacker to bypass system authentication and achieve total switch compromise in ArubaOS-CX Switches version(s): AOS-CX 10.10.xxxx: 10.10.0002 and below, AOS-CX 10.09.xxxx: 10.09.1030 and below, AOS-CX 10.08.xxxx: 10.08.1070 and below, AOS-CX 10.06.xxxx: 10.06.0210 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address this security vulnerability.
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:cx_10000:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:cx_8325:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:cx_8320:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
OR cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:cx_9300:-:*:*:*:*:*:*:*

History

08 Aug 2023, 14:22

Type Values Removed Values Added
CWE CWE-287 NVD-CWE-noinfo

09 Sep 2022, 18:32

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 6.8
CWE CWE-287
CPE cpe:2.3:o:arubanetworks:aos-cx:*:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:cx_9300:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:cx_8320:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:cx_8325:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:cx_10000:-:*:*:*:*:*:*:*
References (MISC) https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt - (MISC) https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt - Vendor Advisory

06 Sep 2022, 18:50

Type Values Removed Values Added
New CVE

Information

Published : 2022-09-06 18:15

Updated : 2024-02-04 22:51


NVD link : CVE-2022-23691

Mitre link : CVE-2022-23691

CVE.ORG link : CVE-2022-23691


JSON object : View

Products Affected

arubanetworks

  • cx_9300
  • aos-cx
  • cx_8325
  • cx_10000
  • cx_8320