CVE-2022-37896

MEDIUM

6.1

CVSS Score

Published: October 7, 2022 at 12:00 AM UTC

Updated: June 17, 2026 at 04:55 AM UTC

4 products affected across 2 vendorsArubaosInstantScalance W1750D Firmware

Using Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; by N/A?

Get instant alerts when new vulnerabilities affect Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series; - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.1

Exploit prediction

EPSS 0.7%

Description

A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the affected interface of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Arubaos · Aruba Networks

95%

v ≤ 10.3.1.0v ≤ 6.4.4.8-4.2.4.20v ≤ 6.5.4.23v ≤ 8.10.0.1v ≤ 8.6.0.18v ≤ 8.7.1.910.3.0.0 ≤ v < 10.3.1.1

Affected range stops below 10.3.1.1, so it looks safe — our inference, not a vendor statement

Instant · Aruba Networks

95%

v ≤ 10.3.1.0v ≤ 6.4.4.8-4.2.4.20v ≤ 6.5.4.23v ≤ 8.10.0.1v ≤ 8.6.0.18v ≤ 8.7.1.96.4.0.0 ≤ v < 6.4.4.8-4.2.4.216.5.0.0 ≤ v < 6.5.4.248.10.0.0 ≤ v < 8.10.0.28.6.0.0 ≤ v < 8.6.0.198.7.0.0 ≤ v < 8.7.1.10

Affected range stops below 6.4.4.8-4.2.4.21, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.5.4.24, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.10.0.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.6.0.19, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.7.1.10, so it looks safe — our inference, not a vendor statement

Scalance W1750D Firmware · Siemens

95%

All versions

siemens-scalance-w1750d (same device)

Scalance W1750D · Siemensdevice

80%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt

References (2)

Third Party Advisory

Source: [email protected]

https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf

Vendor Advisory

Source: [email protected]

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txt

CVSS

6.1MEDIUM[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: REQUIRED
Scope: CHANGED
Confidentiality: LOW
Integrity: LOW
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card