CVE-2022-37897criticalCWE-78

CVE-2022-37897: critical vulnerability in Hewlett Packard Enterprise Aruba Mobility…

Published · Updated

Follow this CVE+ Monitor Aruba Mobility Conductor; Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.9%
There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Hewlett Packard Enterprise · Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central
Related CVEs — Hewlett Packard Enterprise Aruba Mobility…

In the same product, most dangerous first.

CVE-2022-37901HIGHCVE-2022-37901EPSS 3.3%CVE-2022-37900HIGHCVE-2022-37900EPSS 3.3%CVE-2022-37899HIGHCVE-2022-37899EPSS 3.3%CVE-2022-37902HIGHCVE-2022-37902EPSS 1.8%CVE-2022-37912HIGHCVE-2022-37912EPSS 1.7%CVE-2022-37898HIGHCVE-2022-37898EPSS 1.5%