CVE-2023-22791
A vulnerability exists in Aruba InstantOS and ArubaOS 10 where an edge-case combination of network configuration, a specific WLAN environment and an attacker already possessing valid user credentials on that WLAN can lead to sensitive information being…
Does this matter?
Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability exists in Aruba InstantOS and ArubaOS 10 where an edge-case combination of network configuration, a specific WLAN environment and an attacker already possessing valid user credentials on that WLAN can lead to sensitive information being disclosed via the WLAN. The scenarios in which this disclosure of potentially sensitive information can occur are complex and depend on factors that are beyond the control of the attacker.
- CVSS 3.1
- 4.8 MEDIUMCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.24% probability · 15th percentile
- CISA KEV
- Not listed
- Affected
- arubanetworks/arubaos · hp/instantos
- Source
- security-alert@hpe.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.