CVE-2022-37909

MEDIUM

5.3

CVSS Score

Published: November 3, 2022 at 07:31 PM UTC

Updated: October 8, 2026 at 05:13 PM UTC

3 products affected across 2 vendorsArubaosSd WANAruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central

Using Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central by Hewlett Packard Enterprise?

Get instant alerts when new vulnerabilities affect Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.3

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs. The scenarios in which disclosure of potentially sensitive information can occur are complex, and depend on factors beyond the control of attackers.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Arubaos · Aruba Networks

95%

6.5.4.0 ≤ v < 6.5.4.238.4.0.0 ≤ v < 8.6.0.188.7.0.0 ≤ v < 8.7.1.108.8.0.0 ≤ v < 8.10.0.0*10.3.0.0

Affected range stops below 6.5.4.23, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.10.0.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.6.0.18, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.7.1.10, so it looks safe — our inference, not a vendor statement

Sd WAN · Aruba Networks

95%

8.5.0.0-2.1.0.0 ≤ v < 8.7.0.0-2.3.0.7*

Affected range stops below 8.7.0.0-2.3.0.7, so it looks safe — our inference, not a vendor statement

Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central · Hewlett Packard Enterprise

72%

All versions

Vendor states this is fixed in ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above (unaffected)