Missing Encryption of Sensitive Data in Aruba Instant and ArubaOS (AOS) - CVE-2022-47522

Vulnerability identifier: #VU74346

CSH Severity: Medium

CVSS v4: 7.6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-47522

CWE-ID: CWE-311

Exploitation vector: Adjecent network

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the way Wi-Fi devices manage transmit queues. A remote attacker can force the device to send traffic unencrypted by manipulating the transmit queues.

Aruba Instant
SCALANCE W1788-2 EEC M12
SCALANCE W786-1 RJ45
SCALANCE W786-2 RJ45
SCALANCE W786-2 SFP
SCALANCE W786-2IA RJ45
SCALANCE W788-1 M12
SCALANCE W788-1 RJ45
SCALANCE W788-2 M12
SCALANCE W788-2 M12 EEC
SCALANCE W788-2 RJ45
SCALANCE W1748-1 M12
SCALANCE W1788-1 M12
SCALANCE W778-1 M12 EEC (USA)
SCALANCE W1788-2 M12
SCALANCE W1788-2IA M12
SCALANCE WAM763-1
SCALANCE WAM766-1 (EU)
SCALANCE WAM766-1 (US)
SCALANCE WAM766-1 EEC (EU)
SCALANCE WAM766-1 EEC (US)
SCALANCE WUM763-1
SCALANCE WUM766-1 (EU)
SCALANCE WUM766-1 (US)
SCALANCE W722-1 RJ45
SCALANCE W721-1 RJ45
SCALANCE W734-1 RJ45
SCALANCE W734-1 RJ45 (USA)
SCALANCE W738-1 M12
SCALANCE W748-1 M12
SCALANCE W748-1 RJ45
SCALANCE W761-1 RJ45
SCALANCE W774-1 M12 EEC
SCALANCE W774-1 RJ45
SCALANCE W774-1 RJ45 (USA)
SCALANCE W778-1 M12
SCALANCE W778-1 M12 EEC
ArubaOS (AOS)
FreeBSD
SCALANCE W1750D (ROW)
SCALANCE W1750D (USA)
SCALANCE W1750D (JP)
Aruba InstantOS
ArubaOS Wi-Fi Controllers and Gateways

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Aruba InstantOS - addressed in versions 6.4.4.8-4.2.4.21, 6.5.4.24, 8.6.0.19, 8.10.0.0, 10.3.1.1
ArubaOS Wi-Fi Controllers and Gateways - addressed in versions 8.6.0.21, 8.10.0.0

• Exploit #11128 - CVE-2022-47522-exploit () (February 10, 2025)

• https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-005.txt
• https://papers.mathyvanhoef.com/usenix2023-wifi.pdf

• Wi-Fi encryption bypass in Aruba devices
• Missing encryption of sensitive data in HPE Aruba Bypassing Wi-Fi Encryption by Manipulating Transmit Queues
• Multiple vulnerabilities in Siemens SCALANCE W1750D
• Wi-Fi encryption bypass in FreeBSD
• Missing Encryption of Sensitive Data in Siemens SCALANCE W700 Product Family