CVE-2008-7095

Severity: high (CVSS 7.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-08-27 · updated 2026-06-16
Weakness: CWE-264

Description

The SNMP daemon in ArubaOS 3.3.2.6 in Aruba Mobility Controller does not restrict SNMP access, which allows remote attackers to (1) read all SNMP community strings via SNMP-COMMUNITY-MIB::snmpCommunityName (1.3.6.1.6.3.18.1.1.1.2) or SNMP-VIEW-BASED-ACM-MIB::vacmGroupName (1.3.6.1.6.3.16.1.2.1.3) with knowledge of one community string, and (2) read SNMPv3 user names via SNMP-USER-BASED-SM-MIB or SNMP-VIEW-BASED-ACM-MIB.

Affected products

Arubanetworks Aruba Mobility Controller: all versions
Hewlett Packard Enterprise (HPE) ArubaOS (AOS): 3.3.2.6

References

http://osvdb.org/51916
http://www.securityfocus.com/archive/1/498033/100/0/threaded
http://www.securityfocus.com/bid/32102
http://osvdb.org/51916
http://www.securityfocus.com/archive/1/498033/100/0/threaded
http://www.securityfocus.com/bid/32102

Get alerted when CVE-2008-7095 or the next vulnerability affects your stack