CVE-2021-25158

Vulnerability

A remote arbitrary file read vulnerability exists in the Aruba Instant Access Point (IAP) products running Aruba Instant OS versions 6.5.4.18 and below, 8.3.0.14 and below, 8.5.0.11 and below, 8.6.0.7 and below, and 8.7.1.1 and below [1]. The vulnerability allows an unauthenticated attacker to read arbitrary files from the affected device's filesystem.

Exploitation

An attacker can exploit this vulnerability remotely over the network without needing authentication. Specific technical details or a proof-of-concept exploit have been publicly disclosed in a publication by Packet Storm Security [1]. The exact vector and required conditions are not fully detailed in the available reference, but the vulnerability is known to be exploitable without credentials.

Impact

Successful exploitation allows an attacker to read arbitrary files from the device, leading to information disclosure. This could include sensitive configuration data, credentials, and other confidential information stored on the IAP. The attacker may be able to obtain the device's admin password or cryptographic keys, potentially enabling further compromise.

Mitigation

Aruba has released patches addressing this vulnerability for all affected versions. Administrators should upgrade their Aruba Instant IAP firmware to the latest patched versions as specified in Aruba's security advisory. No workaround is provided in the available references. Users should also check if the vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog and apply mitigations accordingly.