CVE-2022-37904: arubanetworks arubaos Write-what-where Condition

Vulnerability summary

CVE-2022-37904 is a high (CVSS 8.8) Write-what-where Condition vulnerability in arubanetworks arubaos. EPSS estimates a 0.76% chance of exploitation in the next 30 days, higher than 54.5% of scored vulnerabilities.

Timeline

1. 03-11-2022
   PublishedVulnerability first disclosed.
2. 02-05-2025
   Last modifiedVulnerability information updated.

Description

Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.

• CWE-123Write-what-where ConditionAny condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.