CVE-2023-38401

HighCVSS 7.8

Published: 15/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 26/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow local users to elevate privileges. Successful exploitation could allow execution of arbitrary code with NT AUTHORITY\SYSTEM privileges on the operating system.

Risk Assessment

The risk involves the possibility of a local attacker gaining full control over the system, which could lead to data theft, malware installation, or further network attacks.

Recommendation

It is recommended to immediately update the HPE Aruba Networking VIA client to the latest version that includes a fix for this vulnerability. Also, restrict local access to systems where the client is installed.

Other vulnerabilities in HPE Aruba Networking Virtual Intranet Access (VIA) client

CVE-2023-38402High
A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM. A successful exploit could create a Denial-of-Service (DoS) condition affecting the Microsoft Windows operating system boot process.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS