CVE-2022-37903

HIGH

8.8

CVSS Score

Published: November 3, 2022 at 07:11 PM UTC

Updated: October 9, 2026 at 05:42 PM UTC

3 products affected across 2 vendorsArubaosSd WANAruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central· also runs on 10 platforms

Using Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central by Hewlett Packard Enterprise?

Get instant alerts when new vulnerabilities affect Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 0.8%

SSVC

No known exploit

Description

A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface. Successful exploitation of this vulnerability could lead to full compromise the underlying host operating system.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Arubaos · Aruba Networks

95%

6.5.4.0 ≤ v < 6.5.4.238.4.0.0 ≤ v < 8.6.0.188.7.0.0 ≤ v < 8.7.1.108.8.0.0 ≤ v < 8.10.0.0*10.3.0.0

Affected range stops below 6.5.4.23, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.6.0.18, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.7.1.10, so it looks safe — our inference, not a vendor statement

arubanetworks-7005 (environment) · arubanetworks-7008 (environment) · arubanetworks-7010 (environment) · arubanetworks-7024 (environment) · arubanetworks-7030 (environment) · arubanetworks-7205 (environment) · arubanetworks-7210 (environment) · arubanetworks-7220 (environment) · arubanetworks-7240xm (environment) · arubanetworks-7280 (environment)

Sd WAN · Aruba Networks

95%

8.5.0.0-2.1.0.0 ≤ v < 8.7.0.0-2.3.0.7*

Affected range stops below 8.7.0.0-2.3.0.7, so it looks safe — our inference, not a vendor statement

Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central · Hewlett Packard Enterprise

65%

All versions

Vendor states this is fixed in ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above (unaffected)