CVE-2023-22791

Summary

A vulnerability exists in Aruba InstantOS and ArubaOS 10 where an edge-case combination of network configuration, a specific WLAN environment and an attacker already possessing valid user credentials on that WLAN can lead to sensitive information being disclosed via the WLAN. The scenarios in which this disclosure of potentially sensitive information can occur are complex and depend on factors that are beyond the control of the attacker.

Affected Software

VendorProductVersion RangeStatus
Hewlett Packard Enterprise (HPE)Aruba Access Points running InstantOS and ArubaOS 10Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and belowaffected
Hewlett Packard Enterprise (HPE)Aruba Access Points running InstantOS and ArubaOS 10Aruba InstantOS 6.5.x: 6.5.4.23 and belowaffected
Hewlett Packard Enterprise (HPE)Aruba Access Points running InstantOS and ArubaOS 10Aruba InstantOS 8.6.x: 8.6.0.19 and belowaffected
Hewlett Packard Enterprise (HPE)Aruba Access Points running InstantOS and ArubaOS 10Aruba InstantOS 8.10.x: 8.10.0.4 and belowaffected
Hewlett Packard Enterprise (HPE)Aruba Access Points running InstantOS and ArubaOS 10ArubaOS 10.3.x: 10.3.1.0 and belowaffected
Hewlett Packard Enterprise (HPE)Aruba Access Points running InstantOS and ArubaOS 10See reference document for further detailsaffected

Weaknesses

  • n/a

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References