CVE-2022-37901

HighCVSS 7.2/10Last modified Oct 9, 2026

Description

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise	Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central	—

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txtVendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txtVendor Advisory

Timeline

Published: Dec 12, 2022
Last modified: Oct 9, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-379027.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitie CVE-2022-379038.8A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web int CVE-2022-379048.8Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequen CVE-2022-379058.8Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequen CVE-2022-379068.1An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of the vulnerability res CVE-2022-379077.5A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an im CVE-2022-379086.5An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can comprom CVE-2022-379095.3Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs. The sce CVE-2022-379106.5A buffer overflow vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in a den CVE-2022-379115.5Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit c CVE-2022-379128.8Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilitie CVE-2022-379139.8Vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote att