CVE-2021-25160

Vulnerability

A remote arbitrary file modification vulnerability exists in the web-based management interface of Aruba Instant Access Point (IAP) products. The issue affects the following firmware versions: Aruba Instant 6.4.x (6.4.4.8-4.2.4.17 and below), 6.5.x (6.5.4.18 and below), 8.3.x (8.3.0.14 and below), 8.5.x (8.5.0.11 and below), 8.6.x (8.6.0.7 and below), and 8.7.x (8.7.1.1 and below). The vulnerability resides in how the interface handles certain HTTPS requests, allowing an attacker to write arbitrary files to the underlying file system without proper authorization [1].

Exploitation

An unauthenticated attacker with network access to the management interface can exploit this vulnerability by sending a specially crafted HTTPS request to the affected device. No valid credentials or prior access are required. The attacker can leverage the interface's trust in the HTTPS request content to specify a file path and payload, resulting in file creation or modification on the IAP's filesystem [1].

Impact

Successful exploitation allows the attacker to modify arbitrary files on the IAP, including critical configuration files or web resources. This can lead to complete compromise of the IAP's configuration, potentially enabling further attacks such as denial of service, credential theft, or system takeover. The impact is high because the attacker operates remotely without authentication and gains file write access [1].

Mitigation

Aruba has released patches addressing this vulnerability. Affected users should update to the latest fixed versions: Instant 6.4.x (6.4.4.8-4.2.4.18 or later), 6.5.x (6.5.4.19 or later), 8.3.x (8.3.0.15 or later), 8.5.x (8.5.0.12 or later), 8.6.x (8.6.0.8 or later), and 8.7.x (8.7.1.2 or later). If patching is not immediately possible, restrict network access to the management interface to trusted IPs only [1].