CVE-2022-37908 Security feature bypass in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central
An authenticated attacker can compromise the hardware chain of trust by impacting the integrity of the ArubaOS bootloader on 7xxx series controllers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-37908?
CVE-2022-37908 is a medium-severity vulnerability in Arubanetworks Arubaos, published on 3 Nov 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.
Weakness: CWE-494
Which versions are affected by CVE-2022-37908?
It affects 2 products.
Products include Arubanetworks Arubaos, Arubanetworks Sd-Wan.
How do I fix CVE-2022-37908?
No fix has been published for CVE-2022-37908 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-37908 being exploited?
There is no known exploitation of CVE-2022-37908 in the wild and no public exploit code.
Other vulnerabilities in Arubanetworks Arubaos
- CVE-2024-42393 Memory corruption in Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
- CVE-2024-42394 Memory corruption in HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
- CVE-2024-42395 Memory corruption in HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
- CVE-2024-31466 Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol
- CVE-2024-31467 Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol
Sources
Also known as GHSA-3x8r-xvj6-wr9x.