This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] HPE Aruba Networking Mobility Conductors, Controllers and Gateways fixes 2 vulnerabilities
HPE Aruba Networking fixes 2 highly severe vulnerabilities in the Mobility Conductors, Mobility Controllers and WLAN and SD-WAN Gateways (AOS-10 and AOS-8) products [1]. Fixes are available in versions: AOS-10 - 10.7.0.0 and 10.4.1.5 AOS-8 - 8.12.0.3 and 8.10.0.15 As a temporary fix for these vulnerabilities, it is possible to restrict the command line and the web interface intended for management to a dedicated layer 2 segment and/or to control access using a firewall at layer 3 or higher [1].
Allows an authenticated remote attacker to overwrite arbitrary system files and execute code in the AOS web management interface [1].
The vulnerability is present in product:
- *:AOS;>=8.10,<=8.10.0.14;>=8.12,<=8.12.0.2;>=10.4,<=10.4.1.4;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-23051 at cve.org, NVD
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 14. 1. 2025.
Allows an authenticated remote attacker to execute arbitrary commands as a privileged user at the operating system level of the affected device in the network management command line [1].
The vulnerability is present in product:
- *:AOS;>=8.10,<=8.10.0.14;>=8.12,<=8.12.0.2;>=10.4,<=10.4.1.4;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-23052 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 14. 1. 2025.
By CESNET, z.s.p.o. Michaela Ručková on 22. 1. 2025.