CVE-2021-25162

Vulnerability

A remote execution of arbitrary commands vulnerability exists in the Aruba Instant Access Point (IAP) software. Affected versions include Aruba Instant 6.4.x (6.4.4.8-4.2.4.17 and below), 6.5.x (6.5.4.18 and below), 8.3.x (8.3.0.14 and below), 8.5.x (8.5.0.11 and below), 8.6.x (8.6.0.7 and below), and 8.7.x (8.7.1.1 and below) [1]. The vulnerability can be exploited remotely without authentication.

Exploitation

An attacker can exploit this vulnerability by sending specially crafted packets to the vulnerable IAP device over the network [1]. No authentication or user interaction is required. The attacker needs network connectivity to the targeted IAP.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands on the affected Aruba Instant IAP device with elevated privileges [1]. This can lead to full compromise of the device, including information disclosure and potential lateral movement within the network.

Mitigation

Aruba has released patches for the affected Aruba Instant versions [1]. Users should upgrade to the following fixed versions: Instant 8.7.1.2 or later, Instant 8.6.0.8 or later, Instant 8.5.0.12 or later, Instant 8.3.0.15 or later, Instant 6.5.4.19 or later, and Instant 6.4.4.8-4.2.4.18 or later. No workaround is disclosed in the available references.