Heap-based buffer overflow in Aruba Networks products - CVE-2022-23676
Published: May 3, 2022
Vulnerability identifier: #VU62752
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2022-23676
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Aruba Networks
Affected software:
Aruba 5400R
Aruba 3810
Aruba 2920
Aruba 2930F
Aruba 2930M
Aruba 2530
Aruba 2540
Aruba 5400R
Aruba 3810
Aruba 2920
Aruba 2930F
Aruba 2930M
Aruba 2530
Aruba 2540
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the RADIUS client implementation. A remote user can pass specially crafted data to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
How to mitigate CVE-2022-23676
Install updates from vendor's website.