Vulnerability Description
An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Arubanetworks | Arubaos | >= 10.3.0.0, < 10.3.1.1 |
| Arubanetworks | Instant | >= 6.4.0.0, < 6.4.4.8-4.2.4.21 |
| Siemens | Scalance W1750D Firmware | All versions |
| Siemens | Scalance W1750D | - |
Related Weaknesses (CWE)
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdfThird Party Advisory
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txtVendor Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdfThird Party Advisory
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txtVendor Advisory
FAQ
What is CVE-2022-37893?
CVE-2022-37893 is a vulnerability with a CVSS score of 7.8 (HIGH). An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of this vulnerability results in the ability to execute ar...
How severe is CVE-2022-37893?
CVE-2022-37893 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-37893?
Check the references section above for vendor advisories and patch information. Affected products include: Arubanetworks Arubaos, Arubanetworks Instant, Siemens Scalance W1750D Firmware, Siemens Scalance W1750D.