CVE-2016-2031
9.8
CRITICAL · CVSS 3.1 · EPSS 5.1% (pctl 92)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to insufficient validation of user-supplied input and insufficient checking of parameters, which could allow a malicious user to bypass security restrictions, obtain sensitive information, perform unauthorized actions and execute arbitrary code.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 5.12% — more likely to be exploited than 92% of all CVEs |
| Weakness | CWE-20 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2020-01-31 |
| Last modified | 2026-06-17 |
Affected (5)
| Vendor | Product |
|---|---|
| arubanetworks | airwave |
| arubanetworks | aruba instant |
| arubanetworks | arubaos |
| siemens | scalance w1750d |
| siemens | scalance w1750d firmware |
References
- http://packetstormsecurity.com/files/136997/Aruba-Authentication-Bypass-Insecure-Transport-Tons-Of-Issues.html
- http://seclists.org/fulldisclosure/2016/May/19
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-004.txt
- https://cert-portal.siemens.com/productcert/pdf/ssa-431802.pdf
- https://www.securityfocus.com/bid/90207
- http://packetstormsecurity.com/files/136997/Aruba-Authentication-Bypass-Insecure-Transport-Tons-Of-Issues.html
- http://seclists.org/fulldisclosure/2016/May/19
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-004.txt
- https://cert-portal.siemens.com/productcert/pdf/ssa-431802.pdf
- https://www.securityfocus.com/bid/90207
→ the Explorer · watch your stack · NVD