Resource exhaustion in Aruba Instant and ArubaOS (AOS) - CVE-2002-20001
Published: September 30, 2022 / Updated: May 4, 2023
Vulnerability identifier: #VU67772
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2002-20001
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in the Diffie-Hellman Key Agreement Protocol. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Affected software
Aruba Instant
ArubaOS (AOS)
ClearPass Policy Manager
IBM Automation Decision Services
ArubaOS (AOS)
ClearPass Policy Manager
IBM Automation Decision Services
How to mitigate CVE-2002-20001
Install updates from vendor's website.
Aruba Instant - addressed in versions 6.4.4.8-4.2.4.21, 6.5.4.24, 8.6.0.19, 8.7.1.10, 8.10.0.2
ArubaOS (AOS) - update to 10.3.1.1
ClearPass Policy Manager - addressed in versions 6.9.13, 6.10.8, 6.11.0
IBM Automation Decision Services - update to 24.0.0.0.4
ArubaOS (AOS) - update to 10.3.1.1
ClearPass Policy Manager - addressed in versions 6.9.13, 6.10.8, 6.11.0
IBM Automation Decision Services - update to 24.0.0.0.4
Links to Public Exploits and PoC-codes
- Exploit #9033 - dheater (D(HE)ater is a proof of concept implementation of the D(HE)at attack (CVE-2002-20001) through which denial-of-service can be performed by enforcing the Diffie-Hellman key exchange. (read-only clone of the original GitLab project)) (May 4, 2023)
- Exploit #8425 - dheater (D(HE)ater is a proof of concept implementation of the D(HE)at attack (CVE-2002-20001) through which denial-of-service can be performed by enforcing the Diffie-Hellman key exchange.) (October 2, 2022)