Auth bypass in Arubanetworks 9004
CVE-2023-38486
A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypass security controls which would normally prohibit unsigned kernel images from executing. An attack…
Vulnerability class: Broken Access Control
EPSS: 0.003 (21.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N.
Affected products
- Arubanetworks 9004
- Arubanetworks 9004-lte
- Arubanetworks 9012
- Arubanetworks 9240
- Arubanetworks Arubaos
- Hewlett Packard Enterprise (Hpe) 9200 Series Mobility Controllers And Sd-wan Gateways, 9000 Gateways — versions ArubaOS 10.4.x.x, ArubaOS 8.11.x.x, ArubaOS 8.10.x.x
Weakness classification (CWE)
References
- security-alert@hpe.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-38486?
- CVE-2023-38486 is a high-severity vulnerability in Arubanetworks 9004, classified under Incorrect Authorization. CVSS score: 7.7/10. Published 2023-09-06.
- How severe is CVE-2023-38486?
- High severity. CVSS v3 base score is 7.7 out of 10.