CVE-2018-7084

high-risk
Published 2019-05-10

A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system commands within the underlying operating system. An attacker could use this ability to copy files, read configuration, write files, delete files, or reboot the device. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.1

Do I need to act?

!
27.3% chance of exploitation in next 30 days
EPSS score — higher than 73% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (2)

Aruba Instant

Affected Vendors

Siemens Arubanetworks

References (6)

Broken Link http://www.securityfocus.com/bid/108374
Third Party Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf
Vendor Advisory https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt
Broken Link http://www.securityfocus.com/bid/108374
Third Party Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf
Vendor Advisory https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt
54
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 15/34 · Moderate
Exposure 7/34 · Low