CVE-2017-9000: hewlett packard enterprise arubaos
Vulnerability summary
CVE-2017-9000 is a critical (CVSS 9.8) vulnerability in hewlett packard enterprise arubaos. EPSS estimates a 5.07% chance of exploitation in the next 30 days, higher than 92.2% of scored vulnerabilities.
Timeline
- 06-08-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
ArubaOS, all versions prior to 6.3.1.25, 6.4 prior to 6.4.4.16, 6.5.x prior to 6.5.1.9, 6.5.2, 6.5.3 prior to 6.5.3.3, 6.5.4 prior to 6.5.4.2, 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally is vulnerable to unauthenticated arbitrary file access. An unauthenticated user with network access to an Aruba mobility controller on TCP port 8080 or 8081 may be able to access arbitrary files stored on the mobility controller. Ports 8080 and 8081 are used for captive portal functionality and are listening, by default, on all IP interfaces of the mobility controller, including captive portal interfaces. The attacker could access files which could contain passwords, keys, and other sensitive information that could lead to full system compromise.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
5.07%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
-0.60 pp
From 5.67% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Hewlett packard enterprise1 product
- arubaosall versions prior to 6.3.1.25 -- 6.4 prior to 6.4.4.16 -- 6.5.x prior to 6.5.1.9 -- 6.5.2 -- 6.5.3 prior to 6.5.3.3 -- 6.5.4 prior to 6.5.4.2 -- 8.x prior to 8.1.0.4 FIPS and non-FIPS versions of software are both affected equally.
Hp1 product
- arubaos< 6.3.1.25 | ≥ 6.4, < 6.4.4.16 | ≥ 6.5.0, < 6.5.1.9 | ≥ 6.5.3, < 6.5.3.3 | ≥ 6.5.4, < 6.5.4.2 | ≥ 8.0, < 8.1.0.4 | 6.5.2
2 vendors · 2 products