CVE-2022-37911 XML external entity in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central

Low 3.8 Published 3 Nov 2022 Updated 2 May 2025

An authenticated attacker can exploit XML entity restrictions in ArubaOS CLI to read local files or cause denial of service.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-37911?

CVE-2022-37911 is a low-severity vulnerability in Arubanetworks Arubaos, published on 3 Nov 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the application to consume system resources, resulting in a denial of service condition.

Weakness: CWE-611

Which versions are affected by CVE-2022-37911?

It affects 2 products.

Products include Arubanetworks Arubaos, Arubanetworks Sd-Wan.

How do I fix CVE-2022-37911?

No fix has been published for CVE-2022-37911 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-37911 being exploited?

There is no known exploitation of CVE-2022-37911 in the wild and no public exploit code.

All Arubanetworks Arubaos vulnerabilities

Sources

Also known as GHSA-2fwm-fp55-mv7p.