A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS Details
- CVSS 3.1 Base Score: 4.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aruba Aos S | — | To address the vulnerabilities described above for the affected release branches, it is recommended to upgrade the software to the following versions:
- ArubaOS-Switch 16.11.xxxx: KB/WC/YA/YB/YC.16.11.0013 and above.
- ArubaOS-Switch 16.10.xxxx: WB.16.10.0024 and above.
- ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0027 and above.
- ArubaOS-Switch 16.04.xxxx: KA/RA.16.04.0027 and above.
- ArubaOS-Switch 15.xx.xxxx: A.15.16.0026 and above.
Note: 16.10.xxxx:KB/WC/YA/YB/YC will not receive fixes for these vulnerabilities. Upgrading to KB/WC/YA/YB/YC.16.11.0013 and above will address these vulnerabilities.
The software versions listed in the Resolution section are the supported branches as of the publication date of this advisory. | Mar 6, 2025 | Aug 29, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub