CVE-2022-37906

HIGH

8.1

CVSS Score

Published: November 3, 2022 at 07:18 PM UTC

Updated: October 8, 2026 at 05:12 PM UTC

3 products affected across 2 vendorsArubaosSd WANAruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central

Using Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central by Hewlett Packard Enterprise?

Get instant alerts when new vulnerabilities affect Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.1

Exploit prediction

EPSS 0.8%

SSVC

No known exploit

Description

An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of the vulnerability results in the ability to delete arbitrary files on the underlying operating system.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Arubaos · Aruba Networks

95%

6.5.4.0 ≤ v < 6.5.4.238.4.0.0 ≤ v < 8.6.0.188.7.0.0 ≤ v < 8.7.1.108.8.0.0 ≤ v < 8.10.0.0*10.3.0.0

Affected range stops below 6.5.4.23, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.10.0.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.6.0.18, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.7.1.10, so it looks safe — our inference, not a vendor statement

Sd WAN · Aruba Networks

95%

8.5.0.0-2.1.0.0 ≤ v < 8.7.0.0-2.3.0.7*

Affected range stops below 8.7.0.0-2.3.0.7, so it looks safe — our inference, not a vendor statement

Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central · Hewlett Packard Enterprise

69%

All versions

Vendor states this is fixed in ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above (unaffected)