CVE-2023-38485

2023-09-0618:15:08

CWE-787

[email protected]

web.nvd.nist.gov

aruba 9200 9000 series controllers gateways bios vulnerability execute arbitrary code early boot sequence gain access change sensitive information system compromise

CVSS3

6.4

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code early in the boot sequence. An attacker could exploit this vulnerability to gain access to and change underlying sensitive information in the affected controller leading to complete system compromise.

Affected configurations

Nvd

Node

arubanetworksarubaosRange8.6.0.0–8.6.0.22

arubanetworksarubaosRange8.10.0.0–8.10.0.7

arubanetworksarubaosRange8.11.0.0–8.11.1.1

arubanetworksarubaosRange10.4.0.0–10.4.0.2

AND

arubanetworks9004Match-

arubanetworks9004-lteMatch-

arubanetworks9012Match-

arubanetworks9240Match-

VendorProductVersionCPE
arubanetworksarubaos*cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
arubanetworks9004-cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*
arubanetworks9004-lte-cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*
arubanetworks9012-cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*
arubanetworks9240-cpe:2.3:h:arubanetworks:9240:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
arubanetworks	arubaos	*	cpe:2.3:o:arubanetworks:arubaos::::::::
arubanetworks	9004	-	cpe:2.3:h:arubanetworks:9004:-:::::::*
arubanetworks	9004-lte	-	cpe:2.3:h:arubanetworks:9004-lte:-:::::::*
arubanetworks	9012	-	cpe:2.3:h:arubanetworks:9012:-:::::::*
arubanetworks	9240	-	cpe:2.3:h:arubanetworks:9240:-:::::::*