CVE-2023-38484

Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code early in the boot sequence. An attacker could exploit this vulnerability to gain access to and change underlying sensitive information in the affected controller leading to complete system compromise.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:arubanetworks:arubaos::::::::
	cpe:2.3:o:arubanetworks:arubaos::::::::
	cpe:2.3:o:arubanetworks:arubaos::::::::
	cpe:2.3:o:arubanetworks:arubaos::::::::

OR	cpe:2.3:h:arubanetworks:9004:-:::::::*
	cpe:2.3:h:arubanetworks:9004-lte:-:::::::*
	cpe:2.3:h:arubanetworks:9012:-:::::::*
	cpe:2.3:h:arubanetworks:9240:-:::::::*

History

15 Sep 2023, 14:19

Type	Values Removed	Values Added
First Time		Arubanetworks arubaos Arubanetworks 9012 Arubanetworks 9240 Arubanetworks Arubanetworks 9004 Arubanetworks 9004-lte
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.4
CPE		cpe:2.3:h:arubanetworks:9012:-:::::::* cpe:2.3:h:arubanetworks:9004-lte:-:::::::* cpe:2.3:o:arubanetworks:arubaos:::::::: cpe:2.3:h:arubanetworks:9004:-:::::::* cpe:2.3:h:arubanetworks:9240:-:::::::*
CWE		CWE-94
References	~~(MISC) https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt -~~	(MISC) https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt - Vendor Advisory

06 Sep 2023, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-06 18:15

Updated : 2023-12-10 15:14

NVD link : CVE-2023-38484

Mitre link : CVE-2023-38484

CVE.ORG link : CVE-2023-38484

JSON object : View

Products Affected

arubanetworks

arubaos
9012
9004
9004-lte
9240

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2023-38484", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.5}, {"type": "Secondary", "source": "security-alert@hpe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.3}]}, "published": "2023-09-06T18:15:08.393", "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could\u00a0allow an attacker to execute arbitrary code early in the boot\u00a0sequence. An attacker could exploit this vulnerability to\u00a0gain access to and change underlying sensitive information\u00a0in the affected controller leading to complete system\u00a0compromise."}, {"lang": "es", "value": "Existen vulnerabilidades en la implementaci\u00f3n de la BIOS de los Controladores y Gateways de las Series 9200 y 9000 de Aruba que podr\u00edan permitir a un atacante ejecutar c\u00f3digo arbitrario en las primeras etapas de la secuencia de inicio. Un atacante podr\u00eda aprovechar esta vulnerabilidad para obtener acceso y cambiar informaci\u00f3n sensible subyacente en el controlador afectado, lo que comprometer\u00eda completamente el sistema."}], "lastModified": "2023-09-15T14:19:09.023", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADB9BE64-9455-46B2-80C8-BD9B88A8F372", "versionEndExcluding": "8.6.0.22", "versionStartIncluding": "8.6.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "48293E3F-C6BD-4875-8C7A-67ED41B7C18D", "versionEndExcluding": "8.10.0.7", "versionStartIncluding": "8.10.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A22E7E61-B318-47C8-8C72-498A17031997", "versionEndExcluding": "8.11.1.1", "versionStartIncluding": "8.11.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6418722E-304A-46EF-8D9E-EB42596F0DFC", "versionEndExcluding": "10.4.0.2", "versionStartIncluding": "10.4.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CFA13FF5-7C60-48B4-AF46-18A9F19D5D42"}, {"criteria": "cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0B1EB3D9-77B5-4DBE-9518-23DD0DA06BC9"}, {"criteria": "cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "17162DB3-973E-47C6-9157-39A0E94603F2"}, {"criteria": "cpe:2.3:h:arubanetworks:9240:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A6BF9E0D-630F-40B4-9109-560CA13C981B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security-alert@hpe.com"}