peter bassill · operator
$ cve CVE-2022-23676 JSON

CVE-2022-23676

9.8
CRITICAL · CVSS 3.1 · EPSS 23% (pctl 98)

Patch early

EPSS 23% — above the 10% action threshold.

Description

A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch 16.03.xxxx: All versions; ArubaOS-Switch 16.04.xxxx: All versions; ArubaOS-Switch 16.05.xxxx: All versions; ArubaOS-Switch 16.06.xxxx: All versions; ArubaOS-Switch 16.07.xxxx: All versions; ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0024 and below; ArubaOS-Switch 16.09.xxxx: KB/WB/WC/YA/YB/YC.16.09.0019 and below; ArubaOS-Switch 16.10.xxxx: KB/WB/WC/YA/YB/YC.16.10.0019 and below; ArubaOS-Switch 16.11.xxxx: KB/WB/WC/YA/YB/YC.16.11.0003 and below. Aruba has released upgrades for ArubaOS-Switch Devices that address these security vulnerabilities.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS22.97% — more likely to be exploited than 98% of all CVEs
WeaknessCWE-787
On CISA KEVno
Public exploitnone known
Published2022-05-10
Last modified2026-06-17

Affected (22)

VendorProduct
arubanetworks2530
arubanetworks2530 firmware
arubanetworks2540
arubanetworks2540 firmware
arubanetworks2615
arubanetworks2615 firmware
arubanetworks2620
arubanetworks2620 firmware
arubanetworks2915
arubanetworks2915 firmware
arubanetworks2920
arubanetworks2920 firmware
arubanetworks2930f
arubanetworks2930f firmware
arubanetworks2930m
arubanetworks2930m firmware
arubanetworks3810m
arubanetworks3810m firmware
arubanetworks5406r
arubanetworks5406r firmware
arubanetworks5412r
arubanetworks5412r firmware

References

→ the Explorer  ·  watch your stack  ·  NVD