CVE-2023-22789
Full vulnerability record from the local CVENow database.
Description
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2023-05-08 15:15:10.503000
Last modified
2026-10-28 19:10:00.193000
View original CVE JSON
{
"id": "CVE-2023-22789",
"sourceIdentifier": "[email protected]",
"published": "2023-05-08T15:15:10.503",
"lastModified": "2026-10-28T19:10:00.193",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system."
},
{
"lang": "es",
"value": "Múltiples vulnerabilidades de inyección de comandos autenticadas existen en la interfaz de línea de comandos de Aruba InstantOS y ArubaOS 10. La explotación exitosa de estas vulnerabilidades resulta en la capacidad de ejecutar comandos arbitrarios como un usuario privilegiado en el sistema operativo subyacente."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Hewlett Packard Enterprise (HPE)",
"product": "Aruba Access Points running InstantOS and ArubaOS 10",
"defaultStatus": "affected",
"versions": [
{
"version": "Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below",
"status": "affected"
},
{
"version": "Aruba InstantOS 6.5.x: 6.5.4.23 and below",
"status": "affected"
},
{
"version": "Aruba InstantOS 8.6.x: 8.6.0.19 and below",
"status": "affected"
},
{
"version": "Aruba InstantOS 8.10.x: 8.10.0.4 and below",
"status": "affected"
},
{
"version": "ArubaOS 10.3.x: 10.3.1.0 and below",
"status": "affected"
},
{
"version": "See reference document for further details",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-01-31T18:03:56.139002Z",
"id": "CVE-2023-22789",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-77"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-77"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.3.0.0",
"versionEndIncluding": "10.3.1.0",
"matchCriteriaId": "E9226A2A-7048-4300-AC20-7629AA05E9D9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.0.0",
"versionEndIncluding": "6.4.4.8-4.2.4.20",
"matchCriteriaId": "93F7D378-2A4F-4A5B-BF1D-3AF38B61C626"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.0.0",
"versionEndIncluding": "6.5.4.23",
"matchCriteriaId": "286BD7C8-D7AB-4DEB-AF86-08E246230A50"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.4.0.0",
"versionEndExcluding": "8.6.0.0",
"matchCriteriaId": "4F892CBE-3BFF-49F6-9101-171C5A4C1503"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.6.0.0",
"versionEndIncluding": "8.6.0.19",
"matchCriteriaId": "7D7E179A-F8E7-49E3-9049-FE8AD39EB0DF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.7.0.0",
"versionEndIncluding": "8.9.0.0",
"matchCriteriaId": "C3A8FE10-DA46-43BF-9713-A844CC935AD9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.10.0.0",
"versionEndIncluding": "8.10.0.4",
"matchCriteriaId": "B1F4CC3E-1DBE-405D-869D-21499960C11B"
}
]
}
]
}
],
"references": [
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-006.txt",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
}
]
}