Authenticated Remote Code Execution in Aruba EdgeConnect Enterprise Command Line Interface
CVE-2023-30502

7.2HIGH

Key Information:

Vendor

HP (HP)

Status
Aruba Edgeconnect Enterprise Software
Vendor
CVE Published:
16 May 2023

What is CVE-2023-30502?

The Aruba EdgeConnect Enterprise command line interface contains vulnerabilities that permit remote authenticated users to execute arbitrary commands on the underlying host system. This flaw could lead to a complete system compromise, allowing unauthorized access and control over sensitive data and resources within the network.

Affected Version(s)

Aruba EdgeConnect Enterprise Software ECOS 9.2.x.x <= 9.2.3.0

Aruba EdgeConnect Enterprise Software ECOS 9.2.x.x <= 9.2.3.0

Aruba EdgeConnect Enterprise Software ECOS 9.1.x.x <= 9.1.5.0

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erik De Jong (bugcrowd.com/erikdejong)
JSON
.