HPE Aruba Networking AOS-CX Authenticated Command Injection Vulnerability

A command injection vulnerability has been identified in the AOS-CX command-line interface (CLI) of HPE Aruba Networking switches. This vulnerability allows low-privilege authenticated remote attackers to inject malicious commands into certain CLI command parameters, potentially leading to unwanted behavior on the device.

Impact

Exploitation of this vulnerability could allow an authenticated remote attacker to execute arbitrary commands on the affected switch, potentially leading to unauthorized access or manipulation of the device's configuration and operations.

Remediation

To address this vulnerability, HPE Aruba Networking recommends upgrading to AOS-CX 10.17.1001 and above, AOS-CX 10.16.1030 and above, AOS-CX 10.13.1161 and above, or AOS-CX 10.10.1180 and above. For switches in the Aruba CX 10000, 4100i, 6000, 6100, 6200F, 6300, 6400, 8320, 8325, 8360, and 8400 Switch Series, please refer to the Vulnerability Summary section of the HPE Aruba Networking AOS-CX Security Bulletin HPESBNW05027 for details on impacted version(s).