Aruba Instant up to 4.2.4.11/6.5.4.10/8.3.0.5/8.3.x command injection

Summaryinfo

A vulnerability classified as critical has been found in Aruba Instant up to 4.2.4.11/6.5.4.10/8.3.0.5/8.3.x. This issue affects some unknown processing. The manipulation leads to command injection. This vulnerability is uniquely identified as CVE-2018-7082. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Aruba Instant up to 4.2.4.11/6.5.4.10/8.3.0.5/8.3.x. It has been rated as critical. This issue affects some unknown processing. The manipulation with an unknown input leads to a command injection vulnerability. Using CWE to declare the problem leads to CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary commands on the underlying operating system. A malicious administrator could use this ability to install backdoors or change system configuration in a way that would not be logged. Workaround: None. Resolution: Fixed in Aruba Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, and 8.4.0.0

The bug was discovered 02/27/2019. The weakness was disclosed 05/10/2019 (Website). It is possible to read the advisory at arubanetworks.com. The identification of this vulnerability is CVE-2018-7082 since 02/15/2018. The attack may be initiated remotely. Required for exploitation is a simple authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 72 days. During that time the estimated underground price was around $5k-$25k.

Upgrading to version 4.2.4.12, 6.5.4.11, 8.3.0.6 or 8.4.0.0 eliminates this vulnerability.

The entries VDB-134566 and VDB-134569 are pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Aruba

Name

• Instant

Version

• 4.2.4.0
• 4.2.4.1
• 4.2.4.2
• 4.2.4.3
• 4.2.4.4
• 4.2.4.5
• 4.2.4.6
• 4.2.4.7
• 4.2.4.8
• 4.2.4.9
• 4.2.4.10
• 4.2.4.11
• 6.5.4.0
• 6.5.4.1
• 6.5.4.2
• 6.5.4.3
• 6.5.4.4
• 6.5.4.5
• 6.5.4.6
• 6.5.4.7
• 6.5.4.8
• 6.5.4.9
• 6.5.4.10
• 8.0
• 8.1
• 8.2
• 8.3
• 8.3.0.0
• 8.3.0.1
• 8.3.0.2
• 8.3.0.3
• 8.3.0.4
• 8.3.0.5

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion