CVE-2023-38401 Local Privilege Escalation in HPE Aruba Networking Virtual Intranet Access (VIA) Microsoft Windows Client
Local users can exploit this vulnerability to execute arbitrary code with SYSTEM privileges on the HPE Aruba VIA client.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-38401?
CVE-2023-38401 is a high-severity vulnerability in Hewlett Packard Enterprise (HPE) HPE Aruba Networking Virtual Intranet Access (VIA), published on 15 Aug 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow local users to elevate privileges. Successful exploitation could allow execution of arbitrary code with NT AUTHORITY\SYSTEM privileges on the operating system.
Which versions are affected by CVE-2023-38401?
It affects 1 product.
Products include Hp Aruba Virtual Intranet Access.
How do I fix CVE-2023-38401?
No fix has been published for CVE-2023-38401 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-38401 being exploited?
There is no known exploitation of CVE-2023-38401 in the wild and no public exploit code.
Other vulnerabilities in Hewlett Packard Enterprise (HPE) HPE Aruba Networking Virtual Intranet Access (VIA)
Sources
Also known as GHSA-vgr3-2f6q-43vm.