Vulnerability identifier: #VU50920

Vulnerability risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-26969

CWE-ID: CWE-611

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
AirWave Management Platform
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor:

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input in the web-based management interface. A remote administrator can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system, leading to denial of service (DoS) attack.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

---

External links
http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-005.txt

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.