CVE-2008-7023

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-08-21 · updated 2026-06-16
Weakness: CWE-310

Description

Aruba Mobility Controller running ArubaOS 3.3.1.16, and possibly other versions, installs the same default X.509 certificate for all installations, which allows remote attackers to bypass authentication. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation.

Affected products

Arubanetworks Aruba Mobility Controller: all versions
Hewlett Packard Enterprise (HPE) ArubaOS (AOS): 3.3.1.16

References

http://osvdb.org/51731
http://www.securityfocus.com/archive/1/496604/100/0/threaded
http://www.securityfocus.com/archive/1/496622/100/0/threaded
http://www.securityfocus.com/bid/31336
http://osvdb.org/51731
http://www.securityfocus.com/archive/1/496604/100/0/threaded
http://www.securityfocus.com/archive/1/496622/100/0/threaded
http://www.securityfocus.com/bid/31336

Get alerted when CVE-2008-7023 or the next vulnerability affects your stack