VYPR
← All advisories
High severity7.8NVD Advisory· Published Oct 7, 2022· Updated Jun 17, 2026

CVE-2022-37893

CVE-2022-37893

Description

An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.

Affected products

6
  • Arubanetworks/Arubaos2 versions
    cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*range: >=10.3.0.0,<10.3.1.1
    • (no CPE)range: <=10.3.1.0
  • Arubanetworks/Instant
    cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*
    Range: >=6.4.0.0,<6.4.4.8-4.2.4.21
  • Siemens Foundation/Scalance W1750d Firmware
    cpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:*
  • Aruba/InstantOS / ArubaOSdescription
  • Arubanetworks/InstantOSllm-create
    Range: <=6.4.4.8-4.2.4.20, <=6.5.4.23, <=8.6.0.18, <=8.7.1.9, <=8.10.0.1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.