CVE-2021-25157

Vulnerability

A remote arbitrary file read vulnerability exists in Aruba Instant Access Point (IAP) products. The affected versions include Aruba Instant 6.4.x (6.4.4.8-4.2.4.17 and below), 6.5.x (6.5.4.18 and below), 8.3.x (8.3.0.14 and below), 8.5.x (8.5.0.11 and below), 8.6.x (8.6.0.6 and below), and 8.7.x (8.7.1.0 and below). The vulnerability allows an attacker to read arbitrary files on the affected device over the network.

Exploitation

An attacker can exploit this vulnerability remotely without requiring authentication. The attacker sends a specially crafted request to the vulnerable IAP device, leveraging the file read flaw to access files outside of the intended web root. No user interaction or special network position beyond network access to the management interface is required.

Impact

Successful exploitation permits an unauthenticated attacker to read arbitrary files from the underlying operating system. This can include sensitive configuration files, credentials, encryption keys, or other confidential data, leading to information disclosure that may facilitate further attacks or compromise of the network.

Mitigation

Aruba has released software patches to address this vulnerability. Administrators should upgrade to the following fixed versions or later: Instant 6.4.4.8-4.2.4.18, Instant 6.5.4.19, Instant 8.3.0.15, Instant 8.5.0.12, Instant 8.6.0.7, and Instant 8.7.1.1. If immediate patching is not possible, restricting network access to the management interface to trusted hosts is recommended. This CVE is not listed on the Known Exploited Vulnerabilities (KEV) catalog as of this writing.

[1]