What is CVE-2023-22789?

CVE-2023-22789 is a high-severity vulnerability in Arubanetworks Arubaos, classified under Command Injection. CVSS score: 7.2/10. Published 2023-05-08.

How severe is CVE-2023-22789?

High severity. CVSS v3 base score is 7.2 out of 10.

RCE in Arubanetworks Arubaos

CVE-2023-22789

Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.017 (74.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Arubanetworks Arubaos
Hewlett Packard Enterprise (Hpe) Aruba Access Points Running Instantos And Arubaos 10 — versions Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below, Aruba InstantOS 6.5.x: 6.5.4.23 and below, Aruba InstantOS 8.6.x: 8.6.0.19 and below
Hp Instantos

Weakness classification (CWE)

CWE-77 — Command Injection

References

security-alert@hpe.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-22789?: CVE-2023-22789 is a high-severity vulnerability in Arubanetworks Arubaos, classified under Command Injection. CVSS score: 7.2/10. Published 2023-05-08.
How severe is CVE-2023-22789?: High severity. CVSS v3 base score is 7.2 out of 10.