CVE-2019-5317: A local authentication bypass vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.18 and below; Aruba…

Medium severity · published Mar 29, 2021

CVE-2019-5317

A local authentication bypass vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.18 and below; Aruba…

6.8

CVSS

0.3%

EPSS

On KEV

Description

A local authentication bypass vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x: 6.5.4.15 and below; Aruba Instant 8.3.x: 8.3.0.11 and below; Aruba Instant 8.4.x: 8.4.0.5 and below; Aruba Instant 8.5.x: 8.5.0.6 and below; Aruba Instant 8.6.x: 8.6.0.2 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Physical

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 21% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Instant · Arubanetworks

6.4.0.0 through 6.4.4.8-4.2.4.18; 6.5.0.0 before 6.5.4.16; 8.3.0.0 before 8.3.0.12; 8.4.0.0 before 8.4.0.6; 8.5.0.0 before 8.5.0.7; 8.6.0.0 before 8.6.0.3 · source: NVD

Scalance W1750d Firmware · Siemens

before 8.7.0 · source: NVD

Affected product

Instant

Arubanetworks

All Instant CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-5317

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-5317

Patch

https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf

Vendor Advisory

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt