CVE-2022-37906

An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of the vulnerability results in the ability to delete arbitrary files on the underlying operating system.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt	Vendor Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:arubanetworks:sd-wan::::::::
	cpe:2.3:o:arubanetworks:arubaos::::::::
	cpe:2.3:o:arubanetworks:arubaos::::::::
	cpe:2.3:o:arubanetworks:arubaos::::::::
	cpe:2.3:o:arubanetworks:arubaos::::::::
	cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:::::::*

History

08 Oct 2026, 17:12

Type	Values Removed	Values Added
CPE		cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:::::::*

Information

Published : 2022-12-12 13:15

Updated : 2026-10-08 17:12

NVD link : CVE-2022-37906

Mitre link : CVE-2022-37906

CVE.ORG link : CVE-2022-37906

JSON object : View

Products Affected

arubanetworks

arubaos
sd-wan

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2022-37906", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-37906", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-05-02T18:48:18.447813Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-alert@hpe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-alert@hpe.com", "affectedData": [{"vendor": "Hewlett Packard Enterprise", "product": "Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central", "versions": [{"status": "unaffected", "version": "ArubaOS 6.5.4.x: 6.5.4.23 and above; ArubaOS 8.6.x: 8.6.0.18 and above; ArubaOS 8.7.x: 8.7.1.10 and above; ArubaOS 8.10.x: 8.10.0.0 and above; ArubaOS 10.3.x: 10.3.0.1 and above; SD-WAN-2.3.0.x: 8.7.0.0-2.3.0.7 and above"}], "defaultStatus": "unaffected"}]}], "published": "2022-12-12T13:15:13.060", "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}, {"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-016.txt", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of the vulnerability results in the ability to delete arbitrary files on the underlying operating system.\n\n"}, {"lang": "es", "value": "Existe una vulnerabilidad de path traversal autenticada en la interfaz de l\u00ednea de comandos de ArubaOS. La explotaci\u00f3n exitosa de la vulnerabilidad da como resultado la capacidad de eliminar archivos arbitrarios en el sistema operativo subyacente."}], "lastModified": "2026-10-08T17:12:43.650", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC956FB3-5185-4DEC-A540-134D9C2000CC", "versionEndExcluding": "8.7.0.0-2.3.0.7", "versionStartIncluding": "8.5.0.0-2.1.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "174292ED-9C76-4815-8DBA-E83CB1A59E96", "versionEndExcluding": "6.5.4.23", "versionStartIncluding": "6.5.4.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "28D7A806-4AB8-49DD-91D0-E81E3B4FD468", "versionEndExcluding": "8.6.0.18", "versionStartIncluding": "8.4.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6E4F019-F048-4E6C-9EC7-B9B6A776C246", "versionEndExcluding": "8.7.1.10", "versionStartIncluding": "8.7.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "000544ED-4C0E-432C-B905-056229FD5F7E", "versionEndExcluding": "8.10.0.0", "versionStartIncluding": "8.8.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84A36EB0-A525-4B05-B9CE-A31145A7157C"}], "operator": "OR"}]}], "sourceIdentifier": "security-alert@hpe.com"}