Medium severity · published Feb 9, 2021
CVE-2021-25141
A security vulnerability has been identified in in certain HPE and Aruba L2/L3 switch firmware
4.4
CVSS
0.3%
EPSS
No
On KEV
Description
A security vulnerability has been identified in in certain HPE and Aruba L2/L3 switch firmware. A data processing error due to improper handling of an unexpected data type in user supplied information to the switch's management interface has been identified. The data processing error could be exploited to cause a crash or reboot in the switch management interface and/or possibly the switch itself leading to local denial of service (DoS). The user must have administrator privileges to exploit this vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
3F
3500 Firmware · Hpe
before k.16.02.0032 · source: NVD
3Y
3500 YL Firmware · Hpe
before k.16.02.0032 · source: NVD
6Y
6200 YL Firmware · Hpe
before k.15.18.0024 · source: NVD
8Z
8200 ZL Firmware · Hpe
before k.15.18.0024 · source: NVD
A2
Aruba 2530ya Firmware · Arubanetworks
before ya.16.10.0012 · source: NVD
A2
Aruba 2530yb Firmware · Arubanetworks
before yb.16.10.0012 · source: NVD
A2
Aruba 2540 Firmware · Arubanetworks
before yc.16.10.0012 · source: NVD
A2
Aruba 2620 Firmware · Arubanetworks
before ra.16.04.0022 · source: NVD
A2
Aruba 2920 Firmware · Arubanetworks
before wb.16.10.0011 · source: NVD
A2
Aruba 2930f Firmware · Arubanetworks
before wc.16.10.0012 · source: NVD
A2
Aruba 2930m Firmware · Arubanetworks
before wc.16.10.0012 · source: NVD
A3
Aruba 3800 Firmware · Arubanetworks
before ka.16.04.0022 · source: NVD