Arubanetworks Aos-Cx vulnerabilities

12 CVEs affecting Arubanetworks Aos-Cx, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-23691, published 2022-09-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-23683, published 2022-09-06. High severity, CVSS 7.2. EPSS: 1.7% chance of exploitation in the next 30 days. Authenticated command injection vulnerabilities exist in the AOS-CX Network Analytics Engine via NAE scripts. Successful exploitation of these vulnerabilities result in the ability to execute…
CVE-2022-23684, published 2022-09-06. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only privileges to escalate their permissions to those of an administrative user.…
CVE-2022-23690, published 2022-09-06. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of AOS-CX could allow a remote unauthenticated attacker to fingerprint the exact version AOS-CX running on the switch. This allows an attacker to…
CVE-2022-23682, published 2022-09-06. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Multiple vulnerabilities exist in the AOS-CX command line interface that could lead to authenticated command injection. A successful exploit could allow an attacker to execute arbitrary commands as…
CVE-2022-23681, published 2022-09-06. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Multiple vulnerabilities exist in the AOS-CX command line interface that could lead to authenticated command injection. A successful exploit could allow an attacker to execute arbitrary commands as…
CVE-2022-23680, published 2022-09-06. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. AOS-CX lacks Anti-CSRF protections in place for state-changing operations. This can potentially be exploited by an attacker to execute commands in the context of another user in ArubaOS-CX Switches…
CVE-2022-23679, published 2022-09-06. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. AOS-CX lacks Anti-CSRF protections in place for state-changing operations. This can potentially be exploited by an attacker to execute commands in the context of another user in ArubaOS-CX Switches…
CVE-2022-23691, published 2022-09-06. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability exists in certain AOS-CX switch models which could allow an attacker with access to the recovery console to bypass normal authentication. A successful exploit allows an attacker to…
CVE-2022-23689, published 2022-09-06. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Multiple vulnerabilities exist in the processing of packet data by the LLDP service of AOS-CX. Successful exploitation of these vulnerabilities may allow an attacker to impact the availability of the…
CVE-2022-23688, published 2022-09-06. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Multiple vulnerabilities exist in the processing of packet data by the LLDP service of AOS-CX. Successful exploitation of these vulnerabilities may allow an attacker to impact the availability of the…

Latest

CVE-2022-23687, published 2022-09-06. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Multiple vulnerabilities exist in the processing of packet data by the LLDP service of AOS-CX. Successful exploitation of these vulnerabilities may allow an attacker to impact the availability of the…
CVE-2022-23686, published 2022-09-06. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Multiple vulnerabilities exist in the processing of packet data by the LLDP service of AOS-CX. Successful exploitation of these vulnerabilities may allow an attacker to impact the availability of the…