HPE Arubaos-Switch vulnerabilities

3 CVEs affecting HPE Arubaos-Switch, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-39268, published 2023-08-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-39267, published 2023-08-29. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. An authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Successful exploitation results in a Denial-of-Service (DoS) condition in the switch.
CVE-2023-39268, published 2023-08-29. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful exploitation of this vulnerability results…
CVE-2023-39266, published 2023-08-29. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface…