Main Vulnerability Database Vulnerabilities #VU53269

Command Injection in Aruba Instant - CVE-2021-25162

Published: May 14, 2021 / Updated: September 29, 2021

Vulnerability identifier: #VU53269

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-25162

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the Web UI. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

Aruba Instant
SCALANCE W1750D

How to mitigate CVE-2021-25162

Install updates from vendor's website.

Aruba Instant - addressed in versions 4.2.4.18, 6.5.4.19, 8.3.0.15, 8.5.0.12, 8.6.0.8, 8.7.1.2

Links to Public Exploits and PoC-codes

Exploit #6803 - CVE-2021-25162 (CVE-2021-25162) (September 29, 2021)

External References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt