Lucene search
HpeCVE-2022-37908HistoryDec 12, 2022 - 1:15 p.m.
CVE-2022-37908
2022-12-1213:15:13
hpe
web.nvd.nist.gov
42
cve-2022-37908
arubaos
bootloader
7xxx series controllers
hardware chain of trust
security vulnerability
CVSS3
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
AI Score
6.4
Confidence
High
EPSS
0.001
Percentile
22.7%
An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.
Affected configurations
Node
arubanetworkssd-wanRange8.7.0.0-2.3.0.0–8.7.0.0-2.3.0.6
ORarubanetworksarubaosRange6.5.4.0–6.5.4.22
ORarubanetworksarubaosRange8.4.0.0–8.6.0.17
ORarubanetworksarubaosRange8.7.0.0–8.7.1.9
ORarubanetworksarubaosRange8.8.0.0–10.3.0.1
arubanetworks7005Match-
ORarubanetworks7008Match-
ORarubanetworks7010Match-
ORarubanetworks7024Match-
ORarubanetworks7030Match-
ORarubanetworks7205Match-
ORarubanetworks7210Match-
ORarubanetworks7220Match-
ORarubanetworks7240xmMatch-
ORarubanetworks7280Match-
| Vendor | Product | Version | CPE |
|---|---|---|---|
| arubanetworks | sd-wan | * | cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:* |
| arubanetworks | arubaos | * | cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:* |
| arubanetworks | 7005 | - | cpe:2.3:h:arubanetworks:7005:-:*:*:*:*:*:*:* |
| arubanetworks | 7008 | - | cpe:2.3:h:arubanetworks:7008:-:*:*:*:*:*:*:* |
| arubanetworks | 7010 | - | cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:* |
| arubanetworks | 7024 | - | cpe:2.3:h:arubanetworks:7024:-:*:*:*:*:*:*:* |
| arubanetworks | 7030 | - | cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:* |
| arubanetworks | 7205 | - | cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:* |
| arubanetworks | 7210 | - | cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:* |
| arubanetworks | 7220 | - | cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:* |
CNA Affected
[
{
"defaultStatus": "unaffected",
"product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"status": "unaffected",
"version": "ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above"
}
]
}
]Related
prion
prion
Design/Logic Flaw
2022-12-12 13:15:00
cvelist
cvelist
CVE-2022-37908
2022-11-03 19:29:32
nvd
nvd
CVE-2022-37908
2022-12-12 13:15:13
CVSS3
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
AI Score
6.4
Confidence
High
EPSS
0.001
Percentile
22.7%
Related for CVE-2022-37908