CVE-2023-39268
MediumCVSS 4.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
CVE-2023-39268 in ArubaOS-Switch is a memory corruption vulnerability that could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful exploitation allows arbitrary code execution as a privileged user on the underlying operating system.
Risk Assessment
Exploitation of this vulnerability could lead to system takeover, posing a serious security threat to the organization. Attackers may gain access to sensitive data and resources.
Recommendation
It is recommended to immediately update ArubaOS-Switch to the latest version to mitigate this vulnerability. Additionally, monitoring network traffic for suspicious packets can help secure the system.
Other vulnerabilities in ArubaOS-Switch
See all- CVE-2023-39267Medium
An authenticated remote code execution vulnerability exists in ArubaOS-Switch. Successful exploitation results in a Denial-of-Service (DoS) condition in the switch.
- CVE-2023-39266High
A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface provided certain configuration options are present. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.
Original NVD description (English source)
A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS