HPE Aruba Networking AOS-CX Command Injection Vulnerability in CLI Allowing Arbitrary Command Execution

A command injection vulnerability has been identified in the command line interface (CLI) of AOS-CX Switches. This vulnerability allows an authenticated remote attacker to execute arbitrary commands on the underlying operating system. The issue arises from certain command parameters that can be manipulated to inject malicious commands, leading to unauthorized execution on the device.

Impact

Exploitation of this vulnerability could result in unauthorized command execution on the affected switch's operating system, potentially allowing for further system manipulation or compromise.

Remediation

Users are advised to upgrade to AOS-CX version 10.17.1001 and above, 10.16.1030 and above, 10.13.1161 and above, or 10.10.1180 and above, depending on their current version. For assistance, contact HPE Services or visit the HPE Networking Support Portal.