CVE-2021-25159

Vulnerability

A remote arbitrary file modification vulnerability exists in Aruba Instant Access Point (IAP) software. The bug affects IAP versions: Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below [1]. The vulnerability is triggered via specially crafted packets sent to the affected device, without requiring any authentication or user interaction, allowing a remote attacker to overwrite arbitrary files on the IAP filesystem.

Exploitation

An unauthenticated attacker with network access to the target IAP can exploit this vulnerability by sending a sequence of specially crafted network packets. The vulnerability lies in the handling of certain input that controls file write operations. The attacker does not need any credentials or prior access. They only need to be able to send network traffic to the vulnerable IAP [1].

Impact

Successful exploitation allows an attacker to modify arbitrary files on the affected access point. This can lead to full compromise of the device, including achieving remote code execution with elevated privileges, as the attacker can overwrite critical system files or inject malicious executables. The vulnerability is rated with a CVSS v3 base score of 9.8, indicating critical severity due to the low attack complexity and high impact on confidentiality, integrity, and availability [1].

Mitigation

Aruba has released patches for the affected Instant versions. The fixed versions are: Aruba Instant 6.4.4.8-4.2.4.18 or later; Aruba Instant 6.5.4.19 or later; Aruba Instant 8.3.0.15 or later; Aruba Instant 8.5.0.12 or later; Aruba Instant 8.6.0.8 or later; Aruba Instant 8.7.1.2 or later. Users should upgrade to the respective patched versions. This CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [1].