OS Command Injection in Aruba Networks products - CVE-2023-1168
Published: March 21, 2023
Vulnerability identifier: #VU73905
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-1168
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation in the AOS-CX Network Analytics Engine. A remote prvileged user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Affected software
Aruba CX 10000 Switch Series
Aruba CX 9300 Switch Series
Aruba CX 8400 Switch Series
Aruba CX 8360 Switch Series
Aruba CX 8325 Switch Series
Aruba CX 8320 Switch Series
Aruba CX 6400 Switch Series
Aruba CX 6300 Switch Series
Aruba CX 6200F Switch Series
AOS-CX 9300 Switch Series
AOS-CX 8400 Switch Series
AOS-CX 10000 Switch Series
AOS-CX 8360 Switch Series
AOS-CX 6200F Switch Series
AOS-CX 8325 Switch Series
AOS-CX 6300 Switch Series
AOS-CX 8320 Switch Series
AOS-CX 6400 Switch Series
ArubaOS-CX (AOS-CX)
Aruba CX 9300 Switch Series
Aruba CX 8400 Switch Series
Aruba CX 8360 Switch Series
Aruba CX 8325 Switch Series
Aruba CX 8320 Switch Series
Aruba CX 6400 Switch Series
Aruba CX 6300 Switch Series
Aruba CX 6200F Switch Series
AOS-CX 9300 Switch Series
AOS-CX 8400 Switch Series
AOS-CX 10000 Switch Series
AOS-CX 8360 Switch Series
AOS-CX 6200F Switch Series
AOS-CX 8325 Switch Series
AOS-CX 6300 Switch Series
AOS-CX 8320 Switch Series
AOS-CX 6400 Switch Series
ArubaOS-CX (AOS-CX)
How to mitigate CVE-2023-1168
Install updates from vendor's website.
ArubaOS-CX (AOS-CX) - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 9300 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 8400 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 10000 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 8360 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 6200F Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 8325 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 6300 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 8320 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 6400 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 9300 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 8400 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 10000 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 8360 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 6200F Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 8325 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 6300 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 8320 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001
AOS-CX 6400 Switch Series - addressed in versions 10.06.0240, 10.10.1030, 10.11.0001