Arubaos Cx
CVE-2023-1168
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system, leading to a complete compromise of the switch running AOS-CX.
AnalysisAI
An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system, leading to a complete compromise of the switch running AOS-CX. Affected products include: Hpe Arubaos-Cx.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.
More in Arubaos Cx
View allAuth bypass in HPE Aruba AOS-CX switch web management.
Authenticated remote attackers can execute arbitrary commands through malformed parameters in AOS-CX CLI commands, achie
An authenticated command injection vulnerability exists in the AOS-CX command line interface. Rated high severity (CVSS
Authenticated administrators of AOS-CX Switches can inject arbitrary commands through a custom binary in the CLI, potent
Authenticated attackers can execute arbitrary OS commands on AOS-CX Switches through improper input validation in the CL
web-based management interface of AOS-CX Switches is affected by url redirection to untrusted site (open redirect) (CVSS
A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote at
A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticate
A command injection vulnerability exists in the AOS-CX Operating System. Rated medium severity (CVSS 6.7), this vulnerab
A command injection vulnerability exists in the AOS-CX Operating System. Rated medium severity (CVSS 6.7), this vulnerab
A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Rated medium severity (CVSS 6.8),
A vulnerability in the SSH restricted shell interface of the network management services allows improper access control
Same weakness CWE-77 – Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today