High severity · published May 8, 2023
CVE-2023-22787
An unauthenticated Denial of Service (DoS) vulnerability exists in a service accessed via the PAPI protocol provided by Aruba InstantOS and ArubaOS 10
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
An unauthenticated Denial of Service (DoS) vulnerability exists in a service accessed via the PAPI protocol provided by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Arubaos · Arubanetworks
10.3.0.0 through 10.3.1.0 · source: NVD
IN
Instantos · HP
6.4.0.0 through 6.4.4.8-4.2.4.20; 6.5.0.0 through 6.5.4.23; 8.4.0.0 before 8.6.0.0; 8.6.0.0 through 8.6.0.19; 8.7.0.0 through 8.9.0.0; 8.10.0.0 through 8.10.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-22787
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-22787
Mitigation
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt
More from Arubaos
9.8
CVE-2024-42509
Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol
9.8
CVE-2024-42507
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
9.8
CVE-2024-42506
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
9.8
CVE-2024-42505
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
9.8
CVE-2024-42393
Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the Soft AP Daemon Service Accessed by the PAPI Protocol