Arubanetworks: community verdicts
2 notable / known-exploited Arubanetworks CVEs the community has triaged.
Show as table
| Year published | CVEs | In CISA KEV |
|---|---|---|
| 2017 | 1 | 1 |
| 2018 | 0 | 0 |
| 2019 | 0 | 0 |
| 2020 | 0 | 0 |
| 2021 | 0 | 0 |
| 2022 | 0 | 0 |
| 2023 | 0 | 0 |
| 2024 | 1 | 0 |
Exploitation first, with newly exploited CVEs rising above old ones
- CVE-2017-5638CRIT 9.8KEVEPSS 100%
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
- CVE-2024-26305CRIT 9.8EPSS 15%
There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.