CVE-2022-23677
HIGH
8.1
CVSS Score
Published: May 10, 2022 at 06:15 PM UTC
Updated: June 17, 2026 at 04:30 AM UTC
23 products affected across 1 vendor2540 Firmware2920 Firmware2530 Firmware
Using ArubaOS-Switch Devices by N/A?
Get instant alerts when new vulnerabilities affect ArubaOS-Switch Devices - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.1
Exploit prediction
EPSS 21%
Description
A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch 16.03.xxxx: All versions; ArubaOS-Switch 16.04.xxxx: All versions; ArubaOS-Switch 16.05.xxxx: All versions; ArubaOS-Switch 16.06.xxxx: All versions; ArubaOS-Switch 16.07.xxxx: All versions; ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0024 and below; ArubaOS-Switch 16.09.xxxx: KB/WB/WC/YA/YB/YC.16.09.0019 and below; ArubaOS-Switch 16.10.xxxx: KB/WB/WC/YA/YB/YC.16.10.0019 and below; ArubaOS-Switch 16.11.xxxx: KB/WB/WC/YA/YB/YC.16.11.0003 and below. Aruba has released upgrades for ArubaOS-Switch Devices that address these security vulnerabilities.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
15.00.0 ≤ v ≤ 15.16.002316.01.0 ≤ v < 16.02.003416.03.0 ≤ v ≤ 16.04.002416.05.0 ≤ v < 16.08.002516.09.0 ≤ v < 16.09.002016.10.0 ≤ v < 16.10.002016.11.0 ≤ v < 16.11.0004
Affected range stops below 16.02.0034, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.08.0025, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.11.0004, so it looks safe — our inference, not a vendor statement
arubanetworks-2530 (same device)
15.00.0 ≤ v ≤ 15.16.002316.01.0 ≤ v < 16.02.003416.03.0 ≤ v ≤ 16.04.002416.05.0 ≤ v < 16.08.002516.09.0 ≤ v < 16.09.002016.10.0 ≤ v < 16.10.002016.11.0 ≤ v < 16.11.0004
Affected range stops below 16.02.0034, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.08.0025, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.11.0004, so it looks safe — our inference, not a vendor statement
arubanetworks-2540 (same device)
15.00.0 ≤ v ≤ 15.16.002316.01.0 ≤ v < 16.02.003416.03.0 ≤ v ≤ 16.04.002416.05.0 ≤ v < 16.08.002516.09.0 ≤ v < 16.09.002016.10.0 ≤ v < 16.10.002016.11.0 ≤ v < 16.11.0004
Affected range stops below 16.02.0034, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.08.0025, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.11.0004, so it looks safe — our inference, not a vendor statement
arubanetworks-2615 (same device)
15.00.0 ≤ v ≤ 15.16.002316.01.0 ≤ v < 16.02.003416.03.0 ≤ v ≤ 16.04.002416.05.0 ≤ v < 16.08.002516.09.0 ≤ v < 16.09.002016.10.0 ≤ v < 16.10.002016.11.0 ≤ v < 16.11.0004
Affected range stops below 16.02.0034, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.08.0025, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.11.0004, so it looks safe — our inference, not a vendor statement
arubanetworks-2620 (same device)
15.00.0 ≤ v ≤ 15.16.002316.01.0 ≤ v < 16.02.003416.03.0 ≤ v ≤ 16.04.002416.05.0 ≤ v < 16.08.002516.09.0 ≤ v < 16.09.002016.10.0 ≤ v < 16.10.002016.11.0 ≤ v < 16.11.0004
Affected range stops below 16.02.0034, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.08.0025, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.11.0004, so it looks safe — our inference, not a vendor statement
arubanetworks-2915 (same device)
15.00.0 ≤ v ≤ 15.16.002316.01.0 ≤ v < 16.02.003416.03.0 ≤ v ≤ 16.04.002416.05.0 ≤ v < 16.08.002516.09.0 ≤ v < 16.09.002016.10.0 ≤ v < 16.10.002016.11.0 ≤ v < 16.11.0004
Affected range stops below 16.02.0034, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.08.0025, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.11.0004, so it looks safe — our inference, not a vendor statement
arubanetworks-2920 (same device)
15.00.0 ≤ v ≤ 15.16.002316.01.0 ≤ v < 16.02.003416.03.0 ≤ v ≤ 16.04.002416.05.0 ≤ v < 16.08.002516.09.0 ≤ v ≤ 16.09.002016.10.0 ≤ v ≤ 16.10.002016.11.0 ≤ v ≤ 16.11.0004
Affected range stops below 16.02.0034, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.08.0025, so it looks safe — our inference, not a vendor statement
arubanetworks-2930f (same device)
15.00.0 ≤ v ≤ 15.16.002316.01.0 ≤ v < 16.02.003416.03.0 ≤ v ≤ 16.04.002416.05.0 ≤ v < 16.08.002516.09.0 ≤ v < 16.09.002016.10.0 ≤ v < 16.10.002016.11.0 ≤ v < 16.11.0004
Affected range stops below 16.02.0034, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.08.0025, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.11.0004, so it looks safe — our inference, not a vendor statement
arubanetworks-2930m (same device)
15.00.0 ≤ v ≤ 15.16.002316.01.0 ≤ v < 16.02.003416.03.0 ≤ v ≤ 16.04.002416.05.0 ≤ v < 16.08.002516.09.0 ≤ v < 16.09.002016.10.0 ≤ v < 16.10.002016.11.0 ≤ v < 16.11.0004
Affected range stops below 16.02.0034, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.08.0025, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.11.0004, so it looks safe — our inference, not a vendor statement
arubanetworks-3810m (same device)
15.00.0 ≤ v ≤ 15.16.002316.01.0 ≤ v < 16.02.003416.03.0 ≤ v < 16.04.002416.05.0 ≤ v < 16.08.002516.09.0 ≤ v < 16.09.002016.10.0 ≤ v < 16.10.002016.11.0 ≤ v < 16.11.0004
Affected range stops below 16.02.0034, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.04.0024, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.08.0025, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.09.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.10.0020, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.11.0004, so it looks safe — our inference, not a vendor statement
arubanetworks-5406r (same device)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (1)
x_refsource_MISCVendor Advisory
Source: [email protected]
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-008.txtCVSS
- Attack Vector
- NETWORK
- Complexity
- HIGH
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- HIGH
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-787
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card