CVE-2021-25156

Vulnerability

A remote arbitrary directory creation vulnerability exists in multiple versions of Aruba Instant Access Point (IAP) software. Affected versions include Aruba Instant 6.4.x (6.4.4.8-4.2.4.17 and below), 6.5.x (6.5.4.18 and below), 8.3.x (8.3.0.14 and below), 8.5.x (8.5.0.11 and below), 8.6.x (8.6.0.6 and below), and 8.7.x (8.7.1.0 and below). The vulnerability (CVE-2021-25156) allows an unauthenticated remote attacker to create directories on the device's filesystem without proper authorization [1]. No special configuration is required for the vulnerable code path to be reachable.

Exploitation

An attacker can exploit this vulnerability over the network without requiring authentication or any prior access to the device. The attack does not require user interaction or a specific race window. By sending specially crafted requests to the affected IAP, the attacker can create directories at arbitrary locations on the filesystem. Detailed exploit techniques have been publicly disclosed [1].

Impact

Successful exploitation enables the attacker to create arbitrary directories on the device. While this vulnerability alone does not directly lead to arbitrary code execution, it can be combined with other flaws (such as CVE-2021-25155) to achieve remote code execution (RCE) with root privileges, giving the attacker full control over the affected access point [1]. The initial impact is to disrupt device integrity and potentially facilitate more severe attacks on the network.

Mitigation

Aruba has released patches for all affected versions. Users should upgrade their Aruba Instant firmware to the following fixed versions or later: 6.4.4.8-4.2.4.18 (if still supported), 6.5.4.19, 8.3.0.15, 8.5.0.12, 8.6.0.7, or 8.7.1.1 [1]. No workarounds have been disclosed. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Users should apply patches as soon as possible.