CVE-2019-5322

HIGH
7.5
CVSS Score
Published: February 12, 2020 at 11:33 PM UTC
Updated: June 17, 2026 at 02:37 AM UTC
15 products affected across 1 vendor2920 Firmware2540 Firmware2930 Firmware

Using Aruba Intelligent Edge Switch 5400 3810 2920 2930 2530 with GigT port 2530 10/100 port or 2540 by N/A?

Get instant alerts when new vulnerabilities affect Aruba Intelligent Edge Switch 5400 3810 2920 2930 2530 with GigT port 2530 10/100 port or 2540 - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.5
Exploit prediction
EPSS 1%

Description

A remotely exploitable information disclosure vulnerability is present in Aruba Intelligent Edge Switch models 5400, 3810, 2920, 2930, 2530 with GigT port, 2530 10/100 port, or 2540. The vulnerability impacts firmware 16.08.* before 16.08.0009, 16.09.* before 16.09.0007 and 16.10.* before 16.10.0003. The vulnerability allows an attacker to retrieve sensitive system information. This attack can be carried out without user authentication under very specific conditions.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

16.08.0 ≤ v < 16.08.000916.09.0 ≤ v < 16.09.000716.10.0 ≤ v < 16.10.0003
Affected range stops below 16.08.0009, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0007, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0003, so it looks safe — our inference, not a vendor statement
arubanetworks-2530-10-100-port (same device)
16.08.0 ≤ v < 16.08.000916.09.0 ≤ v < 16.09.000716.10.0 ≤ v < 16.10.0003
Affected range stops below 16.08.0009, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0007, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0003, so it looks safe — our inference, not a vendor statement
arubanetworks-2530-with-gigt-port (same device)
16.08.0 ≤ v < 16.08.000916.09.0 ≤ v < 16.09.000716.10.0 ≤ v < 16.10.0003
Affected range stops below 16.08.0009, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0007, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0003, so it looks safe — our inference, not a vendor statement
arubanetworks-2540 (same device)
16.08.0 ≤ v < 16.08.000916.09.0 ≤ v < 16.09.000716.10.0 ≤ v < 16.10.0003
Affected range stops below 16.08.0009, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0007, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0003, so it looks safe — our inference, not a vendor statement
arubanetworks-2920 (same device)
16.08.0 ≤ v < 16.08.000916.09.0 ≤ v < 16.09.000716.10.0 ≤ v < 16.10.0003
Affected range stops below 16.08.0009, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0007, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0003, so it looks safe — our inference, not a vendor statement
arubanetworks-2930 (same device)
16.08.0 ≤ v < 16.08.000916.09.0 ≤ v < 16.09.000716.10.0 ≤ v < 16.10.0003
Affected range stops below 16.08.0009, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0007, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0003, so it looks safe — our inference, not a vendor statement
arubanetworks-3810 (same device)
16.08.0 ≤ v < 16.08.000916.09.0 ≤ v < 16.09.000716.10.0 ≤ v < 16.10.0003
Affected range stops below 16.08.0009, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0007, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0003, so it looks safe — our inference, not a vendor statement
arubanetworks-5400r (same device)
v < 16.08.0009
Affected range stops below 16.08.0009, so it looks safe — our inference, not a vendor statement
v < 16.08.0009
Affected range stops below 16.08.0009, so it looks safe — our inference, not a vendor statement
v < 16.08.0009
Affected range stops below 16.08.0009, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

CVSS

Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card