Filtered by vendor Arubanetworks
Subscribe
Total
690 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-73744 | 1 Arubanetworks | 1 Fabric Composer | 2026-09-02 | N/A | 3.5 LOW |
| A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to disrupt the availability of the affected interface. | |||||
| CVE-2026-73746 | 1 Arubanetworks | 1 Fabric Composer | 2026-09-02 | N/A | 3.1 LOW |
| A denial-of-service vulnerability exists in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service. | |||||
| CVE-2026-73747 | 1 Arubanetworks | 1 Fabric Composer | 2026-09-02 | N/A | 2.5 LOW |
| A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user with local access to elevate their user privileges and make limited modifications on the affected system. | |||||
| CVE-2026-76657 | 1 Arubanetworks | 1 Fabric Composer | 2026-09-02 | N/A | 10.0 CRITICAL |
| Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host. | |||||
| CVE-2026-73748 | 1 Arubanetworks | 1 Fabric Composer | 2026-09-02 | N/A | 2.2 LOW |
| A vulnerability in the affected interface of HPE Networking Fabric Composer allows an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Fabric Composer. | |||||
| CVE-2026-76658 | 1 Arubanetworks | 1 Fabric Composer | 2026-09-02 | N/A | 10.0 CRITICAL |
| A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise. | |||||
| CVE-2026-23812 | 1 Arubanetworks | 18 7010, 7030, 7205 and 15 more | 2026-06-17 | N/A | 4.3 MEDIUM |
| A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique. Successful exploitation enables the redirection of data streams, allowing for the interception or modification of traffic intended for the legitimate network gateway via a Machine-in-the-Middle (MitM) position. | |||||
| CVE-2026-23811 | 1 Arubanetworks | 18 7010, 7030, 7205 and 15 more | 2026-06-17 | N/A | 4.3 MEDIUM |
| A vulnerability in the client isolation mechanism may allow an attacker to bypass Layer 2 (L2) communication restrictions between clients and redirect traffic at Layer 3 (L3). In addition to bypassing policy enforcement, successful exploitation - when combined with a port-stealing attack - may enable a bi-directional Machine-in-the-Middle (MitM) attack. | |||||
| CVE-2026-23810 | 1 Arubanetworks | 18 7010, 7030, 7205 and 15 more | 2026-06-17 | N/A | 4.3 MEDIUM |
| A vulnerability in the packet processing logic may allow an authenticated attacker to craft and transmit a malicious Wi-Fi frame that causes an Access Point (AP) to classify the frame as group-addressed traffic and re-encrypt it using the Group Temporal Key (GTK) associated with the victim's BSSID. Successful exploitation may enable GTK-independent traffic injection and, when combined with a port-stealing technique, allows an attacker to redirect intercepted traffic to facilitate machine-in-the-middle (MitM) attacks across BSSID boundaries. | |||||
| CVE-2026-23809 | 1 Arubanetworks | 18 7010, 7030, 7205 and 15 more | 2026-06-17 | N/A | 5.4 MEDIUM |
| A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs. By leveraging the relationship between BSSIDs and their associated virtual ports, an attacker could potentially bypass inter-BSSID isolation controls. Successful exploitation may enable an attacker to redirect and intercept the victim's network traffic, potentially resulting in eavesdropping, session hijacking, or denial of service. | |||||
| CVE-2026-23808 | 1 Arubanetworks | 18 7010, 7030, 7205 and 15 more | 2026-06-17 | N/A | 5.4 MEDIUM |
| A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to install an attacker-controlled Group Temporal Key (GTK) on a client device. Successful exploitation of this vulnerability could allow a remote malicious actor to perform unauthorized frame injection, bypass client isolation, interfere with cross-client traffic, and compromise network segmentation, integrity, and confidentiality. | |||||
| CVE-2026-23601 | 1 Arubanetworks | 18 7010, 7030, 7205 and 15 more | 2026-06-17 | N/A | 5.4 MEDIUM |
| A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions. A malicious actor can generate shared-key authenticated transmissions containing targeted payloads while impersonating the identity of a primary BSSID.Successful exploitation allows for the delivery of tampered data to specific endpoints, bypassing standard cryptographic separation. | |||||
| CVE-2025-37185 | 1 Arubanetworks | 1 Edgeconnect Sd-wan Orchestrator | 2026-06-17 | N/A | 5.5 MEDIUM |
| Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attacks against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface and thereby make unauthorized arbitrary configuration changes to the host. | |||||
| CVE-2025-37184 | 1 Arubanetworks | 1 Edgeconnect Sd-wan Orchestrator | 2026-06-17 | N/A | 9.8 CRITICAL |
| A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Successful exploitation could allow an attacker to create an admin user account without the necessary multi-factor authentication, thereby compromising the integrity of secured access to the system. | |||||
| CVE-2025-37183 | 1 Arubanetworks | 1 Edgeconnect Sd-wan Orchestrator | 2026-06-17 | N/A | 7.2 HIGH |
| Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized data access or data manipulation. | |||||
| CVE-2025-37182 | 1 Arubanetworks | 1 Edgeconnect Sd-wan Orchestrator | 2026-06-17 | N/A | 7.2 HIGH |
| Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized data access or data manipulation. | |||||
| CVE-2025-37181 | 1 Arubanetworks | 1 Edgeconnect Sd-wan Orchestrator | 2026-06-17 | N/A | 7.2 HIGH |
| Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized data access or data manipulation. | |||||
| CVE-2025-37179 | 1 Arubanetworks | 1 Arubaos | 2026-06-17 | N/A | 5.3 MEDIUM |
| Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. Under specific conditions, this can result in a crash of the affected process and a potential denial-of-service of the compromised process. | |||||
| CVE-2025-37178 | 1 Arubanetworks | 1 Arubaos | 2026-06-17 | N/A | 5.3 MEDIUM |
| Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. Under specific conditions, this can result in a crash of the affected process and a potential denial-of-service of the compromised process. | |||||
| CVE-2025-37177 | 1 Arubanetworks | 1 Arubaos | 2026-06-17 | N/A | 6.5 MEDIUM |
| An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation of this vulnerability could allow an authenticated remote malicious actor to delete arbitrary files within the affected system. | |||||