CVE-2022-23677

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 20.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-10 · updated 2026-06-17
Weakness: CWE-787

Description

A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch 16.03.xxxx: All versions; ArubaOS-Switch 16.04.xxxx: All versions; ArubaOS-Switch 16.05.xxxx: All versions; ArubaOS-Switch 16.06.xxxx: All versions; ArubaOS-Switch 16.07.xxxx: All versions; ArubaOS-Switch 16.08.xxxx: KB/WB/WC/YA/YB/YC.16.08.0024 and below; ArubaOS-Switch 16.09.xxxx: KB/WB/WC/YA/YB/YC.16.09.0019 and below; ArubaOS-Switch 16.10.xxxx: KB/WB/WC/YA/YB/YC.16.10.0019 and below; ArubaOS-Switch 16.11.xxxx: KB/WB/WC/YA/YB/YC.16.11.0003 and below. Aruba has released upgrades for ArubaOS-Switch Devices that address these security vulnerabilities.

Affected products

Arubanetworks 2530 Firmware: from 15.00.0 through 15.16.0023; from 16.01.0 before 16.02.0034; from 16.03.0 through 16.04.0024; from 16.05.0 before 16.08.0025; from 16.09.0 before 16.09.0020; from 16.10.0 before 16.10.0020 — fixed in 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020, 16.11.0004
Arubanetworks 2540 Firmware: from 15.00.0 through 15.16.0023; from 16.01.0 before 16.02.0034; from 16.03.0 through 16.04.0024; from 16.05.0 before 16.08.0025; from 16.09.0 before 16.09.0020; from 16.10.0 before 16.10.0020 — fixed in 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020, 16.11.0004
Arubanetworks 2615 Firmware: from 15.00.0 through 15.16.0023; from 16.01.0 before 16.02.0034; from 16.03.0 through 16.04.0024; from 16.05.0 before 16.08.0025; from 16.09.0 before 16.09.0020; from 16.10.0 before 16.10.0020 — fixed in 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020, 16.11.0004
Arubanetworks 2620 Firmware: from 15.00.0 through 15.16.0023; from 16.01.0 before 16.02.0034; from 16.03.0 through 16.04.0024; from 16.05.0 before 16.08.0025; from 16.09.0 before 16.09.0020; from 16.10.0 before 16.10.0020 — fixed in 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020, 16.11.0004
Arubanetworks 2915 Firmware: from 15.00.0 through 15.16.0023; from 16.01.0 before 16.02.0034; from 16.03.0 through 16.04.0024; from 16.05.0 before 16.08.0025; from 16.09.0 before 16.09.0020; from 16.10.0 before 16.10.0020 — fixed in 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020, 16.11.0004
Arubanetworks 2920 Firmware: from 15.00.0 through 15.16.0023; from 16.01.0 before 16.02.0034; from 16.03.0 through 16.04.0024; from 16.05.0 before 16.08.0025; from 16.09.0 before 16.09.0020; from 16.10.0 before 16.10.0020 — fixed in 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020, 16.11.0004
Arubanetworks 2930F Firmware: from 15.00.0 through 15.16.0023; from 16.01.0 before 16.02.0034; from 16.03.0 through 16.04.0024; from 16.05.0 before 16.08.0025; from 16.09.0 through 16.09.0020; from 16.10.0 through 16.10.0020 — fixed in 16.02.0034, 16.08.0025
Arubanetworks 2930M Firmware: from 15.00.0 through 15.16.0023; from 16.01.0 before 16.02.0034; from 16.03.0 through 16.04.0024; from 16.05.0 before 16.08.0025; from 16.09.0 before 16.09.0020; from 16.10.0 before 16.10.0020 — fixed in 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020, 16.11.0004
Arubanetworks 3810M Firmware: from 15.00.0 through 15.16.0023; from 16.01.0 before 16.02.0034; from 16.03.0 through 16.04.0024; from 16.05.0 before 16.08.0025; from 16.09.0 before 16.09.0020; from 16.10.0 before 16.10.0020 — fixed in 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020, 16.11.0004
Arubanetworks 5406R Firmware: from 15.00.0 through 15.16.0023; from 16.01.0 before 16.02.0034; from 16.03.0 before 16.04.0024; from 16.05.0 before 16.08.0025; from 16.09.0 before 16.09.0020; from 16.10.0 before 16.10.0020 — fixed in 16.02.0034, 16.04.0024, 16.08.0025, 16.09.0020, 16.10.0020, 16.11.0004
Arubanetworks 5412R Firmware: from 15.00.0 through 15.16.0023; from 16.01.0 before 16.02.0034; from 16.03.0 through 16.04.0024; from 16.05.0 before 16.08.0025; from 16.09.0 before 16.09.0020; from 16.10.0 before 16.10.0020 — fixed in 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020, 16.11.0004

How to fix

Upgrade to a fixed version: Arubanetworks 2530 Firmware 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020; Arubanetworks 2540 Firmware 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020; Arubanetworks 2615 Firmware 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020; Arubanetworks 2620 Firmware 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020; Arubanetworks 2915 Firmware 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020; Arubanetworks 2920 Firmware 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020; Arubanetworks 2930F Firmware 16.02.0034, 16.08.0025; Arubanetworks 2930M Firmware 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020; Arubanetworks 3810M Firmware 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020; Arubanetworks 5406R Firmware 16.02.0034, 16.04.0024, 16.08.0025, 16.09.0020; Arubanetworks 5412R Firmware 16.02.0034, 16.08.0025, 16.09.0020, 16.10.0020. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-23677 or the next vulnerability affects your stack