CVE-2023-38402
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM. A successful exploit could create a Denial-of-Service (DoS) condition affecting the Microsoft Windows operating system boot process.
Risk Assessment
The risk involves potential permanent damage to the operating system by overwriting critical boot files, preventing Windows from starting and requiring technical intervention.
Recommendation
Immediately update the HPE Aruba Networking VIA client to the latest version available on the vendor's website and restrict application access to trusted users only.
Other vulnerabilities in HPE Aruba Networking Virtual Intranet Access (VIA) client
Original NVD description (English source)
A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM. A successful exploit could allow these malicious users to create a Denial-of-Service (DoS) condition affecting the Microsoft Windows operating System boot process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS