CVE-2023-45626

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across boot cycles.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Acc	ArubaOS 10.5.x.x: 10.5.0.0 and below; ArubaOS 10.4.x.x: 10.4.0.2 and below; InstantOS 8.11.x.x: 8.11.1.2 and below; InstantOS 8.10.x.x: 8.10.0.8 and below; InstantOS 8.6.x.x: 8.6.0.22 and below

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txtMitigation, Vendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txtMitigation, Vendor Advisory

Timeline

Published: Nov 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-456276.5An authenticated Denial-of-Service (DoS) vulnerability exists in the CLI service. Successful exploitation of this vulnerability results in t CVE-2023-456285.4Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in QROkes QR Twitter Widget plugin <= 0.2.3 versions.CVE-2023-456298.8Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.CVE-2023-456306.1Unauth. Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versio CVE-2023-456315.4Missing Authorization vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Exploiting Incorrectly Configured Access Cont CVE-2023-456326.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado SpiderVPlayer plugin <= 1.5.22 versions.CVE-2023-456336.5Missing Authorization vulnerability in IDX IMPress Listings allows Exploiting Incorrectly Configured Access Control Security Levels.This iss CVE-2023-456346.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Biztechc Copy or Move Comments plugin <= 5.0.4 versions.CVE-2023-456355.4Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Darko Responsive Tabs allows Code Injectio CVE-2023-456365.4Missing Authorization vulnerability in WebToffee WordPress Backup & Migration wp-migration-duplicator allows Exploiting Incorrectly Configur CVE-2023-456376.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime EventPrime – Events Calendar, Bookings and Tickets plugin <= 3.1.5 CVE-2023-456388.8Cross-Site Request Forgery (CSRF) vulnerability in euPago Eupago Gateway For Woocommerce plugin <= 3.1.9 versions.