Vulnerability Description
A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only privileges to escalate their permissions to those of an administrative user. Successful exploitation of this vulnerability allows an attacker to escalate privileges beyond their authorized level in ArubaOS-CX Switches version(s): AOS-CX 10.09.xxxx: 10.09.1020 and below, AOS-CX 10.08.xxxx: 10.08.1060 and below, AOS-CX 10.06.xxxx: 10.06.0200 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address this security vulnerability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Arubanetworks | Aos-Cx | >= 10.06.0000, < 10.06.0210 |
| Arubanetworks | Cx 10000 | - |
| Arubanetworks | Cx 8325 | - |
| Arubanetworks | Cx 8320 | - |
| Arubanetworks | Cx 9300 | - |
| Arubanetworks | Cx 8360 | - |
| Arubanetworks | Cx 6400 | - |
| Arubanetworks | Cx 6300 | - |
| Arubanetworks | Cx 6200F | - |
| Arubanetworks | Cx 6100 | - |
| Arubanetworks | Cx 6000 | - |
| Arubanetworks | Cx 4100I | - |
| Arubanetworks | Cx 8400 | - |
References
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txtVendor Advisory
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txtVendor Advisory
FAQ
What is CVE-2022-23684?
CVE-2022-23684 is a vulnerability with a CVSS score of 8.8 (HIGH). A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only privileges to escalate their permissions to those of an administrative user. Succ...
How severe is CVE-2022-23684?
CVE-2022-23684 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-23684?
Check the references section above for vendor advisories and patch information. Affected products include: Arubanetworks Aos-Cx, Arubanetworks Cx 10000, Arubanetworks Cx 8325, Arubanetworks Cx 8320, Arubanetworks Cx 9300.