CVE-2021-37732 Command injection in HPE Aruba Instant (IAP)
Remote attackers can execute arbitrary commands on HPE Aruba Instant Access Points, requiring immediate patching.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-37732?
CVE-2021-37732 is a high-severity command injection vulnerability in Siemens Scalance W1750d Firmware, published on 12 Oct 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x.x: 6.5.4.18 and below; Aruba Instant 8.5.x.x: 8.5.0.11 and below; Aruba Instant 8.6.x.x: 8.6.0.6 and below; Aruba Instant 8.7.x.x: 8.7.1.0 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability.
Weakness: CWE-78
Which versions are affected by CVE-2021-37732?
It affects 2 products.
Products include Arubanetworks Aruba Instant, Siemens Scalance W1750d Firmware.
How do I fix CVE-2021-37732?
No fix has been published for CVE-2021-37732 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-37732 being exploited?
There is no known exploitation of CVE-2021-37732 in the wild and no public exploit code.
Other vulnerabilities in Siemens Scalance W1750d Firmware
Sources
Also known as GHSA-2p98-83jv-9mj3.