CVE-2023-38485

Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code early in the boot sequence. An attacker could exploit this vulnerability to gain access to and change underlying sensitive information in the affected controller leading to complete system compromise.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:arubanetworks:arubaos::::::::
	cpe:2.3:o:arubanetworks:arubaos::::::::
	cpe:2.3:o:arubanetworks:arubaos::::::::
	cpe:2.3:o:arubanetworks:arubaos::::::::

OR	cpe:2.3:h:arubanetworks:9004:-:::::::*
	cpe:2.3:h:arubanetworks:9004-lte:-:::::::*
	cpe:2.3:h:arubanetworks:9012:-:::::::*
	cpe:2.3:h:arubanetworks:9240:-:::::::*

History

No history.

Information

Published : 2023-09-06 18:15

Updated : 2023-09-15 17:40

NVD link : CVE-2023-38485

Mitre link : CVE-2023-38485

CVE.ORG link : CVE-2023-38485

JSON object : View

Products Affected

arubanetworks

9240
9012
arubaos
9004
9004-lte

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2023-38485", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.5}, {"type": "Secondary", "source": "security-alert@hpe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.3}]}, "published": "2023-09-06T18:15:08.480", "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could\u00a0allow an attacker to execute arbitrary code early in the boot\u00a0sequence. An attacker could exploit this vulnerability to\u00a0gain access to and change underlying sensitive information\u00a0in the affected controller leading to complete system\u00a0compromise."}, {"lang": "es", "value": "Existen vulnerabilidades en la implementaci\u00f3n del BIOS de los Controladores y Gateways de las Series 9200 y 9000 de Aruba que podr\u00edan permitir a un atacante ejecutar c\u00f3digo arbitrario en las primeras etapas de la secuencia de inicio. Un atacante podr\u00eda aprovechar esta vulnerabilidad para obtener acceso y cambiar informaci\u00f3n sensible subyacente en el controlador afectado, lo que comprometer\u00eda completamente el sistema."}], "lastModified": "2023-09-15T17:40:14.727", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADB9BE64-9455-46B2-80C8-BD9B88A8F372", "versionEndExcluding": "8.6.0.22", "versionStartIncluding": "8.6.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "48293E3F-C6BD-4875-8C7A-67ED41B7C18D", "versionEndExcluding": "8.10.0.7", "versionStartIncluding": "8.10.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A22E7E61-B318-47C8-8C72-498A17031997", "versionEndExcluding": "8.11.1.1", "versionStartIncluding": "8.11.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6418722E-304A-46EF-8D9E-EB42596F0DFC", "versionEndExcluding": "10.4.0.2", "versionStartIncluding": "10.4.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42"}, {"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9"}, {"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2"}, {"criteria": "cpe:2.3:h:arubanetworks:9240:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A6BF9E0D-630F-40B4-9109-560CA13C981B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security-alert@hpe.com"}