CVE-2023-38485

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code early in the boot sequence. An attacker could exploit this vulnerability to gain access to and change underlying sensitive information in the affected controller leading to complete system compromise.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	9200 Series Mobility Controllers and SD-WAN Gateways, 9000 Series Mobility Controllers and SD-WAN Gateways	>= ArubaOS 10.4.x.x, <= <=10.4.0.1; >= ArubaOS 8.11.x.x, <= <=8.11.1.0; >= ArubaOS 8.10.x.x, <= <=8.10.0.6; >= ArubaOS 8.6.x.x, <= <=8.6.0.21
hewlett_packard_enterprise	9200_series_mobility_controllers_and_sd-wan_gateways_9000_series_mobility_controllers_and_sd-wan	>= aruba-os_8.11.x.x, <= 8.11.1.0; >= aruba-os_10.4.x.x, <= 10.4.0.1; >= aruba-os_8.10.x.x, <= 8.10.0.6; >= aruba-os_8.11.x.x, <= 8.6.0.21

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txtVendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txtVendor Advisory

Timeline

Published: Sep 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-384866.4A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypa CVE-2023-384878.2HedgeDoc is software for creating real-time collaborative markdown notes. Prior to version 1.9.9, the API of HedgeDoc 1 can be used to creat CVE-2023-384888.8Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby s CVE-2023-384897.3Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby s CVE-2023-38496.1A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /fin CVE-2023-3849010.0Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby CVE-2023-384915.4Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby s CVE-2023-384927.5Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby s CVE-2023-384937.5Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via CVE-2023-384947.5MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere CVE-2023-384959.8Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1 CVE-2023-384963.3Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container networ