CVE-2023-35974

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central	- ArubaOS 10.4.x.x: 10.4.0.1 and below; - ArubaOS 8.11.x.x: 8.11.1.0 and below; - ArubaOS 8.10.x.x: 8.10.0.6 and below; - ArubaOS 8.6.x.x: 8.6.0.20 and below

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txtVendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txtVendor Advisory

Timeline

Published: Jul 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-359758.1An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability re CVE-2023-359766.5Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successfu CVE-2023-359776.5Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successfu CVE-2023-359786.1A vulnerability in ArubaOS could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a CVE-2023-359797.5There is an unauthenticated buffer overflow vulnerability in the process controlling the ArubaOS web-based management interface. Successful CVE-2023-35988.8Out of bounds read and write in ANGLE in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corrupti CVE-2023-359809.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin CVE-2023-359819.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin CVE-2023-359829.8There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sendin CVE-2023-359835.5This issue was addressed with improved data protection. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7 CVE-2023-359844.3The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An attacker CVE-2023-359858.8An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to prop