VulnerabilityModified

CVE-2022-37908

An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers.

MEDIUM 6.5EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.25% probability · 16th percentile
CISA KEV: Not listed
Weakness: CWE-494
Affected: arubanetworks/sd-wan · arubanetworks/arubaos
Source: security-alert@hpe.com

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txtVendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txtVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.