CVE-2022-37898 : Security Advisory and Response

This article provides details about CVE-2022-37898, an authenticated command injection vulnerability in ArubaOS affecting Hewlett Packard Enterprise products.

Understanding CVE-2022-37898

CVE-2022-37898 is an authenticated command injection vulnerability in the ArubaOS command line interface, allowing attackers to execute arbitrary commands as a privileged user on the underlying operating system.

What is CVE-2022-37898?

An authenticated command injection vulnerability exists in ArubaOS, specifically impacting Aruba Mobility Conductor, Aruba Mobility Controllers, WLAN Gateways, and SD-WAN Gateways managed by Aruba Central. Successful exploitation of this vulnerability enables the execution of arbitrary commands with high impact on confidentiality, integrity, and availability.

The Impact of CVE-2022-37898

The impact of CVE-2022-37898 is rated as high severity, with a CVSS base score of 7.2. The attack complexity is low, with a network-based attack vector. The vulnerability requires high privileges for exploitation and does not involve user interaction. The consequence of successful exploitation includes unauthorized command execution with elevated privileges.

Technical Details of CVE-2022-37898

Vulnerability Description

The vulnerability allows authenticated attackers to inject and execute arbitrary commands within the ArubaOS command line interface, leading to unauthorized access and potential system compromise.

Affected Systems and Versions

Hewlett Packard Enterprise products running the following versions are affected:

ArubaOS 6.5.4.x: 6.5.4.23 and above
ArubaOS 8.6.x: 8.6.0.18 and above
ArubaOS 8.7.x: 8.7.1.10 and above
ArubaOS 8.10.x: 8.10.0.0 and above
ArubaOS 10.3.x: 10.3.0.1 and above
SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above

Exploitation Mechanism

Attackers with authenticated access to the affected systems can exploit this vulnerability by injecting malicious commands via the command line interface, granting them unauthorized control and access to the underlying operating system.

Mitigation and Prevention

Immediate Steps to Take

To mitigate the risk posed by CVE-2022-37898, it is recommended to apply security patches or updates provided by Hewlett Packard Enterprise for the affected products. Additionally, restricting and monitoring access to the command line interface can help prevent unauthorized command execution.

Long-Term Security Practices

Implementing strong access controls, conducting regular security assessments, and employing network segmentation can enhance overall system security and resilience against command injection vulnerabilities.

Patching and Updates

Stay informed about security advisories and updates released by Hewlett Packard Enterprise for ArubaOS products to ensure timely deployment of patches addressing CVE-2022-37898.