CVE-2023-35972

Authenticated Remote Command Execution in ArubaOS Web-based Management Interface

HIGH

7.2

CVSS Score

Published: July 5, 2023 at 02:44 PM UTC

Updated: June 17, 2026 at 06:05 AM UTC

17 products affected across 2 vendorsArubaosSd WANMc-Va-10

Using Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central by Hewlett Packard Enterprise (HPE)?

Get instant alerts when new vulnerabilities affect Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.2

Exploit prediction

EPSS 2%

SSVC

No known exploit

Description

An authenticated remote command injection vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Arubaos · Aruba Networks

95%

10.4.0.0 ≤ v < 10.4.0.26.5.4.0 ≤ v < 8.6.0.218.11.0.0 ≤ v < 8.11.1.18.7.0.0 ≤ v < 8.10.0.7

Affected range stops below 10.4.0.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.10.0.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.11.1.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.6.0.21, so it looks safe — our inference, not a vendor statement

arubanetworks-mc-va-10 (environment) · arubanetworks-mc-va-1k (environment) · arubanetworks-mc-va-250 (environment) · arubanetworks-mc-va-50 (environment) · arubanetworks-mcr-hw-10k (environment) · arubanetworks-mcr-hw-1k (environment) · arubanetworks-mcr-hw-5k (environment) · arubanetworks-mcr-va-10k (environment) · arubanetworks-mcr-va-1k (environment) · arubanetworks-mcr-va-50 (environment) · arubanetworks-mcr-va-500 (environment) · arubanetworks-mcr-va-5k (environment) · arubanetworks-sd-wan (environment)

Aruba Mobility Conductor · Hewlett Packard Enterprise HPE

60%

v ≤ 10.4.0.1v ≤ 8.10.0.6v ≤ 8.11.1.0v ≤ 8.6.0.20

Aruba Mobility Controller · Hewlett Packard Enterprise HPE

60%

v ≤ 10.4.0.1v ≤ 8.10.0.6v ≤ 8.11.1.0v ≤ 8.6.0.20

Aruba Sd WAN Gateway · Hewlett Packard Enterprise HPE

60%

v ≤ 10.4.0.1v ≤ 8.10.0.6v ≤ 8.11.1.0v ≤ 8.6.0.20

Mc-Va-10 · Aruba Networksdevice

80%

All versions