Auth bypass in Arubanetworks 9004
CVE-2023-38486
A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypass security controls which would normally prohibit unsigned kernel images from executing. An attacker can use this vulnerability to execute arbitrary runtime operating systems, including unverified and unsigned OS images.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.003 (25.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 26th percentile — 25.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Arubanetworks 9004
- Arubanetworks 9004-Lte
- Arubanetworks 9012
- Arubanetworks 9240
- Arubanetworks Arubaos
- Hewlett Packard Enterprise (HPE) 9200 Series Mobility Controllers And Sd-Wan Gateways, 9000 Gateways — versions ArubaOS 10.4.x.x, ArubaOS 8.11.x.x, ArubaOS 8.10.x.x
Weakness classification (CWE)
References
- www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-38486?
- CVE-2023-38486 is a high-severity vulnerability in Arubanetworks 9004, classified under Incorrect Authorization. CVSS score: 7.7/10. Published 2023-09-06.
- How severe is CVE-2023-38486?
- High severity. CVSS v3 base score is 7.7 out of 10.