On BIG-IP versions 11.6.0-11.6.2 (fixed in 11.6.2 HF1), 12.0.0-12.1.2 HF1 (fixed in 12.1.2 HF2), or 13.0.0-13.0.0 HF2 (fixed in 13.0.0 HF3) a virtual server configured with a Client SSL profile may be vulnerable to an Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) against RSA, which when exploited, may result in plaintext recovery of encrypted messages and/or a Man-in-the-middle (MiTM) attack, despite the attacker not having gained access to the server's private key itself, aka a ROBOT attack.
CVSS Details
- CVSS 3.0 Base Score: 7.4
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aruba Aos Cx | — | The vulnerabilities contained in this advisory can be addressed
by patching or upgrading to one of the versions listed below
AOS-CX 10.06.xxxx: 10.06.0180 and above
AOS-CX 10.07.xxxx: 10.07.0061 and above
AOS-CX 10.08.xxxx: 10.08.1040 and above
AOS-CX 10.09.xxxx: 10.09.0010 and above
Aruba recommends that users using the following branches
upgrade to 10.06.0180 and above to address these vulnerabilities:
AOS-CX 10.05.xxxx and below
None of the above branch versions will address the UEFI
vulnerabilities mentioned in ARUBA-PSA-2022-001. | Feb 24, 2025 | Feb 22, 2022 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Nov 17, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub