CVE-2022-23678

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-06 · updated 2026-06-17

Description

A vulnerability in the Aruba Virtual Intranet Access (VIA) client for Microsoft Windows operating system client communications that could allow for an attacker in a privileged network position to intercept sensitive information in Aruba Virtual Intranet Access (VIA) client for Microsoft Windows operating system versions: 4.3.0 build 2208101 and below. Aruba has released upgrades for Virtual Intranet Access (VIA) Client that address this security vulnerability.

Affected products

Hewlett Packard Enterprise (HPE) HPE Aruba Networking Virtual Intranet Access (VIA): before 4.3.0 — fixed in 4.3.0

How to fix

Upgrade to a fixed version: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Virtual Intranet Access (VIA) 4.3.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-23678 or the next vulnerability affects your stack