CVE-2022-37911

MEDIUM

5.5

CVSS Score

Published: November 3, 2022 at 07:36 PM UTC

Updated: October 8, 2026 at 05:14 PM UTC

3 products affected across 2 vendorsArubaosSd WANAruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central

Using Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central by Hewlett Packard Enterprise?

Get instant alerts when new vulnerabilities affect Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.7%

SSVC

No known exploit

Description

Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the application to consume system resources, resulting in a denial of service condition.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Arubaos · Aruba Networks

95%

6.5.4.0 ≤ v < 6.5.4.238.4.0.0 ≤ v < 8.6.0.188.7.0.0 ≤ v < 8.7.1.108.8.0.0 ≤ v < 8.10.0.0*10.3.0.0

Affected range stops below 6.5.4.23, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.10.0.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.6.0.18, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.7.1.10, so it looks safe — our inference, not a vendor statement

Sd WAN · Aruba Networks

95%

8.5.0.0-2.1.0.0 ≤ v < 8.7.0.0-2.3.0.7*

Affected range stops below 8.7.0.0-2.3.0.7, so it looks safe — our inference, not a vendor statement

Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central · Hewlett Packard Enterprise

69%

All versions

Vendor states this is fixed in ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above (unaffected)