Critical severity · published May 10, 2019
CVE-2018-7084
A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system commands within the…
9.8
CVSS
4.6%
EPSS
No
On KEV
Description
A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system commands within the underlying operating system. An attacker could use this ability to copy files, read configuration, write files, delete files, or reboot the device. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.1
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.6% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Aruba Instant · Arubanetworks
4.0 before 4.2.4.12; 6.5.0 before 6.5.4.11; 8.3.0 before 8.3.0.6; 8.4.0 before 8.4.0.1 · source: NVD
SW
Scalance W1750d Firmware · Siemens
before 8.4.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7084
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7084
Broken Link
http://www.securityfocus.com/bid/108374
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf
Vendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt
More from Aruba Instant
9.8
CVE-2021-37726
A remote buffer overflow vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 8.7.x.x: 8.7.0.0 through 8.7.1.2
9.8
CVE-2016-2031
Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to insufficient validation of user-supplied input and insufficient checking of parameters, which…
7.5
CVE-2016-2032
A vulnerability exists in the Aruba AirWave Management Platform 8.x prior to 8.2 in the management interface of an underlying system component called RabbitMQ, which could let a…
7.5
CVE-2018-7083
If a process running within Aruba Instant crashes, it may leave behind a "core dump", which contains the memory contents of the process at the time it crashed
7.2
CVE-2021-37732
A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x.x:…