by Kastro
Paper/Archive/CVE-2023-39268

CVE-2023-39268

Hewlett Packard Enterprise ArubaOS-Switch — Memory Corruption Vulnerability in ArubaOS-Switch

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.4.574 × 2011.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

Affected

ProductAffectedFixed inSource
ArubaOS-SwitchArubaOS-Switch 16.11.xxxx: KB/WC/YA/YB/YC.16.11.0012 and below.–CNA
ArubaOS-SwitchArubaOS-Switch 16.10.xxxx: KB/WC/YA/YB/YC.16.10.0025 and below.–CNA
ArubaOS-SwitchArubaOS-Switch 16.10.xxxx: WB.16.10.23 and below.–CNA
ArubaOS-SwitchArubaOS-Switch 16.09.xxxx: All versions.–CNA
ArubaOS-SwitchArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0026 and below.–CNA
ArubaOS-SwitchArubaOS-Switch 16.07.xxxx: All versions.–CNA
ArubaOS-SwitchArubaOS-Switch 16.06.xxxx: All versions.–CNA
ArubaOS-SwitchArubaOS-Switch 16.05.xxxx: All versions.–CNA
ArubaOS-SwitchArubaOS-Switch 16.04.xxxx: KA/RA.16.04.0026 and below.–CNA
ArubaOS-SwitchArubaOS-Switch 16.03.xxxx: All versions.–CNA
ArubaOS-SwitchArubaOS-Switch 16.02.xxxx: All versions.–CNA
ArubaOS-SwitchArubaOS-Switch 16.01.xxxx: All versions.–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
hpe (CNA)4.5CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refarubanetworks.com/assets/alert/ARUBA-PSA-2023-013.txt