CVE-2023-3718

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands on the underlying operating system as a privileged user on the affected switch. This allows an attacker to fully compromise the underlying operating system on the device running AOS-CX.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
Hewlett Packard Enterprise (HPE)Aruba CX SwitchesAOS-CX 10.11.xxxx: 10.11.1010 and below; AOS-CX 10.10.xxxx: 10.10.1050 and below
hewlett_packard_enterprisearuba_cx_switches>= 10.11, <= 10.11.1010; >= 10.10, <= 10.10.1050

References

Timeline

Published
Aug 1, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-371857.5C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_prec_decompress at zfp/blosc2-zfp.c.CVE-2023-371867.5C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference in ndlz/ndlz8x8.c via a NULL pointer to memset.CVE-2023-371877.5C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_decompress. function.CVE-2023-371887.5C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompress at zfp/blosc2-zfp.c.CVE-2023-371894.8A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attackers to execute arbitCVE-2023-371904.8A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTMLCVE-2023-371914.8A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTMLCVE-2023-371927.5Memory management and protection issues in Bitcoin Core v22 allows attackers to modify the stored sending address within the app's memory, pCVE-2023-371946.7A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATCVE-2023-371954.4A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATCVE-2023-371968.8A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that couldCVE-2023-371978.8A CWE-89: Improper Neutralization of Special Elements vulnerability used in an SQL Command ('SQL Injection') vulnerability exists that could
CVE-2023-3718: High severity, CVSS 8.8 | Vulnix