Aruba AOS-S: CVE-2022-23676: Heap Overflow Vulnerabilities in RADIUS EAP Messages

Multiple heap overflow vulnerabilities have been discovered in the AOS-S firmware. Successful exploitation of these vulnerabilities could result in the ability to execute arbitrary code. Exploitation of these vulnerabilities requires an attacker-controlled RADIUS server capable of sending access challenge messages to an affected switch. Because of this, exploitation of these vulnerabilities would most likely occur as part of an attack chain building upon previous exploitation of customer controlled infrastructure. Only AOS-S devices that are configured to use RADIUS are affected by these vulnerabilities.