What’s Vulnerable › Vulnerabilities

CVE-2019-5322

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-02-13 · updated 2026-06-17

Description

A remotely exploitable information disclosure vulnerability is present in Aruba Intelligent Edge Switch models 5400, 3810, 2920, 2930, 2530 with GigT port, 2530 10/100 port, or 2540. The vulnerability impacts firmware 16.08.* before 16.08.0009, 16.09.* before 16.09.0007 and 16.10.* before 16.10.0003. The vulnerability allows an attacker to retrieve sensitive system information. This attack can be carried out without user authentication under very specific conditions.

Affected products

• Arubanetworks 2530 10/100 Port Firmware: from 16.08.0 before 16.08.0009; from 16.09.0 before 16.09.0007; from 16.10.0 before 16.10.0003 — fixed in 16.08.0009, 16.09.0007, 16.10.0003
• Arubanetworks 2530 With Gigt Port Firmware: from 16.08.0 before 16.08.0009; from 16.09.0 before 16.09.0007; from 16.10.0 before 16.10.0003 — fixed in 16.08.0009, 16.09.0007, 16.10.0003
• Arubanetworks 2540 Firmware: from 16.08.0 before 16.08.0009; from 16.09.0 before 16.09.0007; from 16.10.0 before 16.10.0003 — fixed in 16.08.0009, 16.09.0007, 16.10.0003
• Arubanetworks 2920 Firmware: from 16.08.0 before 16.08.0009; from 16.09.0 before 16.09.0007; from 16.10.0 before 16.10.0003 — fixed in 16.08.0009, 16.09.0007, 16.10.0003
• Arubanetworks 2930 Firmware: from 16.08.0 before 16.08.0009; from 16.09.0 before 16.09.0007; from 16.10.0 before 16.10.0003 — fixed in 16.08.0009, 16.09.0007, 16.10.0003
• Arubanetworks 3810 Firmware: from 16.08.0 before 16.08.0009; from 16.09.0 before 16.09.0007; from 16.10.0 before 16.10.0003 — fixed in 16.08.0009, 16.09.0007, 16.10.0003
• Arubanetworks 5400R Firmware: from 16.08.0 before 16.08.0009; from 16.09.0 before 16.09.0007; from 16.10.0 before 16.10.0003 — fixed in 16.08.0009, 16.09.0007, 16.10.0003

How to fix

Upgrade to a fixed version: Arubanetworks 2530 10/100 Port Firmware 16.08.0009, 16.09.0007, 16.10.0003; Arubanetworks 2530 With Gigt Port Firmware 16.08.0009, 16.09.0007, 16.10.0003; Arubanetworks 2540 Firmware 16.08.0009, 16.09.0007, 16.10.0003; Arubanetworks 2920 Firmware 16.08.0009, 16.09.0007, 16.10.0003; Arubanetworks 2930 Firmware 16.08.0009, 16.09.0007, 16.10.0003; Arubanetworks 3810 Firmware 16.08.0009, 16.09.0007, 16.10.0003; Arubanetworks 5400R Firmware 16.08.0009, 16.09.0007, 16.10.0003. Check the vendor advisory for mitigations.

References

• https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-001.txt
• https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-001.txt

Get alerted when CVE-2019-5322 or the next vulnerability affects your stack