10

CVE-2018-7084: arubanetworks aruba_instant OS Command Injection

CVSS: 10.0v2.0HighModified
Published 10-05-2019Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2018-7084 is a high (CVSS 10.0) OS Command Injection vulnerability in arubanetworks aruba_instant. EPSS estimates a 4.63% chance of exploitation in the next 30 days, higher than 91.5% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
10.0/10
010
High · v2.0 (NVD)
EPSS score
4.63%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 10-05-2019
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system commands within the underlying operating system. An attacker could use this ability to copy files, read configuration, write files, delete files, or reboot the device. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.1

CVSS metrics

2 scores · 1 source · 2 versions

EPSS trend

Probability

4.63%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

0.00 pp

From 4.63% on 18-09-2026

18-09-202618-10-2026
EPSS score
4.63%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Arubanetworks1 product
  • aruba_instant≥ 4.0, < 4.2.4.12 | ≥ 6.5.0, < 6.5.4.11 | ≥ 8.3.0, < 8.3.0.6 | ≥ 8.4.0, < 8.4.0.1
Siemens1 product

2 vendors · 2 products

References

3 links