HP Airwave vulnerabilities

6 CVEs affecting HP Airwave, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-2202, published 2023-09-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-8527, published 2018-08-06. Medium severity, CVSS 6.1. EPSS: 13.2% chance of exploitation in the next 30 days. Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). The vulnerability is present in the VisualRF component of AirWave. By exploiting…
CVE-2016-8526, published 2018-08-06. High severity, CVSS 8.8. EPSS: 10.1% chance of exploitation in the next 30 days. Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a way to permit XML parsers to access storage that exist on external systems. If…
CVE-2015-2201, published 2023-09-05. High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days. Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users.
CVE-2015-2202, published 2023-09-05. High severity, CVSS 7.2. EPSS: 0.8% chance of exploitation in the next 30 days. Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS.
CVE-2015-1390, published 2023-09-05. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator.
CVE-2015-1391, published 2023-09-05. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.