CVE-2018-16417

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-30 · updated 2026-06-17
Weakness: CWE-77

Description

Aruba Instant 4.x prior to 6.4.4.8-4.2.4.12, 6.5.x prior to 6.5.4.11, 8.3.x prior to 8.3.0.6, and 8.4.x prior to 8.4.0.1 allows Command injection.

Affected products

Arubanetworks Instant: from 4.0.0.0 before 4.2.4.12; from 6.5.0.0 before 6.5.4.11; from 8.3.0.0 before 8.3.0.6; from 8.4.0.0 before 8.4.0.1 — fixed in 4.2.4.12, 6.5.4.11, 8.3.0.6, 8.4.0.1
Siemens W1750D Firmware: before 8.4.0.1 — fixed in 8.4.0.1

How to fix

Upgrade to a fixed version: Arubanetworks Instant 4.2.4.12, 6.5.4.11, 8.3.0.6, 8.4.0.1; Siemens W1750D Firmware 8.4.0.1. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/108374
https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf
https://www.anquanke.com/vul/id/1652568
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt
https://www.us-cert.gov/ics/advisories/ICSA-19-134-07
http://www.securityfocus.com/bid/108374
https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf
https://www.anquanke.com/vul/id/1652568
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt
https://www.us-cert.gov/ics/advisories/ICSA-19-134-07

Get alerted when CVE-2018-16417 or the next vulnerability affects your stack