CVE-2022-37904

HIGH

8.8

CVSS Score

Published: November 3, 2022 at 07:13 PM UTC

Updated: October 9, 2026 at 05:39 PM UTC

3 products affected across 2 vendorsArubaosSd WANAruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central· also runs on 10 platforms

Using Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central by Hewlett Packard Enterprise?

Get instant alerts when new vulnerabilities affect Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 0.8%

SSVC

No known exploit

Description

Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Arubaos · Aruba Networks

95%

6.5.4.0 ≤ v < 6.5.4.238.4.0.0 ≤ v < 8.6.0.188.7.0.0 ≤ v < 8.7.1.108.8.0.0 ≤ v < 8.10.0.0*10.3.0.0

Affected range stops below 6.5.4.22, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.6.0.17, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.7.1.9, so it looks safe — our inference, not a vendor statement

arubanetworks-7005 (environment) · arubanetworks-7008 (environment) · arubanetworks-7010 (environment) · arubanetworks-7024 (environment) · arubanetworks-7030 (environment) · arubanetworks-7205 (environment) · arubanetworks-7210 (environment) · arubanetworks-7220 (environment) · arubanetworks-7240xm (environment) · arubanetworks-7280 (environment)

Sd WAN · Aruba Networks

95%

8.5.0.0-2.1.0.0 ≤ v < 8.7.0.0-2.3.0.7*

Affected range stops below 8.7.0.0-2.3.0.6, so it looks safe — our inference, not a vendor statement

Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central · Hewlett Packard Enterprise

60%

All versions

Vendor states this is fixed in ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above (unaffected)