What is CVE-2023-38484?

CVE-2023-38484 is a high-severity vulnerability in Arubanetworks 9004, classified under Code Injection. CVSS score: 8.0/10. Published 2023-09-06.

How severe is CVE-2023-38484?

High severity. CVSS v3 base score is 8.0 out of 10.

RCE in Arubanetworks 9004

CVE-2023-38484

Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code early in the boot sequence. An attacker could exploit this vulnerability to gain…

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.004 (33.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Arubanetworks 9004
Arubanetworks 9004-lte
Arubanetworks 9012
Arubanetworks 9240
Arubanetworks Arubaos
Hewlett Packard Enterprise (Hpe) 9200 Series Mobility Controllers And Sd-wan Gateways, 9000 Gateways — versions ArubaOS 10.4.x.x, ArubaOS 8.11.x.x, ArubaOS 8.10.x.x

Weakness classification (CWE)

CWE-94 — Code Injection

References

security-alert@hpe.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-38484?: CVE-2023-38484 is a high-severity vulnerability in Arubanetworks 9004, classified under Code Injection. CVSS score: 8.0/10. Published 2023-09-06.
How severe is CVE-2023-38484?: High severity. CVSS v3 base score is 8.0 out of 10.