Aruba Networks, a subsidiary of Hewlett Packard Enterprise, has recently released a security advisory to inform its customers about six critical-severity vulnerabilities impacting multiple versions of ArubaOS, its proprietary network operating system. The affected devices include Aruba Mobility Conductor, Aruba Mobility Controllers, and Aruba-managed WLAN Gateways and SD-WAN Gateways.
The critical flaws addressed by Aruba Networks can be separated into two categories: command injection flaws and stack-based buffer overflow problems in the PAPI protocol. The command injection vulnerabilities are tracked as CVE-2023-22747, CVE-2023-22748, CVE-2023-22749, and CVE-2023-22750, with a CVSS v3 rating of 9.8 out of 10.0. An unauthenticated, remote attacker can leverage them by sending specially crafted packets to the PAPI over UDP port 8211, resulting in arbitrary code execution as a privileged user on ArubaOS.
The stack-based buffer overflow bugs are tracked as CVE-2023-22751 and CVE-2023-22752 and also have a CVSS v3 rating of 9.8. These flaws are exploitable by sending specially crafted packets to the PAPI over UDP port 8211, allowing unauthenticated, remote attackers to run arbitrary code as privileged users on ArubaOS.
The impact of these vulnerabilities is significant, as ArubaOS is a popular network operating system used by many enterprises. The affected versions are ArubaOS 22.214.171.124 and below, ArubaOS 126.96.36.199 and below, ArubaOS 10.3.1.0 and below, and SD-WAN 188.8.131.52-184.108.40.206 and below.
Aruba has advised users to upgrade to the target upgrade versions to mitigate the vulnerabilities. The target versions for the different systems are as follows:
ArubaOS 220.127.116.11 and above
ArubaOS 18.104.22.168 and above
ArubaOS 10.3.1.1 and above
SD-WAN 22.214.171.124-126.96.36.199 and above
However, it is important to note that several product versions that have reached End of Life (EoL) are also affected by these vulnerabilities and will not receive a fixing update. These include ArubaOS 6.5.4.x, ArubaOS 8.7.x.x, ArubaOS 8.8.x.x, ArubaOS 8.9.x.x, and SD-WAN 188.8.131.52-2.2.x.x. System administrators who cannot apply the security updates or are using EoL devices can enable the “Enhanced PAPI Security” mode using a non-default key as a workaround.
It is also worth noting that applying the mitigations does not address another 15 high-severity and eight medium-severity vulnerabilities listed in Aruba’s security advisory, which are fixed by the new versions.
Aruba has stated that it is unaware of any public discussion, exploit code, or active exploitation of these vulnerabilities as of the release date of the advisory, February 28, 2022. However, given the severity of the vulnerabilities, it is important for enterprises to take prompt action to upgrade their systems or implement the recommended mitigations to avoid potential attacks that could lead to data breaches and other security incidents.
Despite the recent security advisory, Aruba Networks remains a leading provider of cutting-edge networking products and services that are designed to meet the unique needs of today’s businesses. Let’s explore some of their key products with ArubaOS.
HPE JZ320A – Aruba AP303 Access Point
JZ320A is the Aruba AP-303 (RW) Dual 2×2:2 MU-MIMO Radio Internal Antennas Unified Campus AP. The affordable mid-range Aruba 303 Series campus access point delivers high performance 802.11ac with MU-MIMO (Wave 2) for medium density enterprise environments. With the integrated BLE and supporting 802.3af power, the Aruba 303 Series AP enables enterprises to improve their work efficiency and productivity with the lowest TCO.
|Product Name||Aruba AP-303 (RW) Dual 2×2:2 MU-MIMO Radio Internal Antennas Unified Campus AP|
|Manufacturer Part Number||JZ320A|
|Product Type||Wireless Access Point|
|Wireless LAN Standard||IEEE 802.11ac|
|Frequency Band||5 GHz
|Total Number of Antennas||2|
|Number of Internal Antennas||2|
|Wireless Transmission Speed||1.20 Gbit/s|
|Ethernet Technology||Gigabit Ethernet|
|Number of Network (RJ-45) Ports||1|
|PoE PD Port||Yes|
|Form Factor||Ceiling Mountable
The 510 series uses 802.11ax features to efficiently and simultaneously serve multiple clients and traffic types in dense environments, increasing data rates for both individual device and overall system.
|Ports||(1) HPE SmartRate RJ-45 port (maximum negotiated speed 2.5Gbps), (1) 10/100/1000BASE-T Ethernet|
|Mounting||Pre-installed mounting bracket, for use with optional mounting kit|
|Input voltage||PoE/PoE+ or direct DC power (via optional power supply)|
|Power Consumption||POE powered (802.3at): 19W (802.3at PoE), 13.5W (802.3af PoE), 17 W (DC power supply)|
|Wi-Fi antenna||Four RP-SMA connectors for external dual-band antennas.|
|Radio coverage||Dual-radio IEEE 802.11ax access point with OFDMA and Multi-User MIMO (MU-MIMO). Supports up to 4.8 Gbps in the 5GHz band (with 4SS/HE160 clients) and up to 575 Mbps in the 2.4GHz band (with 2SS/ HE40 clients).|
|Product Dimensions (imperial)||1.8 x 7.9 x 7.9 in|
JW743A – HPE Aruba 7200 Series Controllers
|Device Type||Network management device|
|Form Factor||Rack-mountable – 1U|
|Data Link Protocol||Ethernet, Fast Ethernet, Gigabit Ethernet, 10 Gigabit Ethernet|
|Performance||Firewall throughput: 20 Gbps|
|Capacity||Maximum number of access points: 512 / Concurrent devices: 16384 / Virtual interfaces (VLANs): 4094 / Concurrent GRE tunnels: 8192 / Maximum RAPs: 512 / Concurrent tunneled ports: 8192 / Concurrent IPSec sessions: 16384 / Concurrent SSL fallback sessions: 8192 / Active firewall sessions: 2015291|
|Power||AC 120/230 V (50/60 Hz)|
|Dimensions (WxDxH)||17.5 in x 17.5 in x 1.7 in|
The Aruba 8400 Switch Series is a core and aggregation switch solution with an innovative and powerful approach to dealing with the new applications, security and scalability demands of the mobile, cloud and IoT era.
|Media & Performance|
|Media Type Supported||Optical Fiber|
|Ethernet Technology||10 Gigabit Ethernet, 40 Gigabit Ethernet, 100 Gigabit Ethernet|
|Network Technology||10GBase-X, 40GBase-X, 100GBase-X|
|Number of Total Expansion Slots||8|
|Network & Communication|
|Management & Protocols|
|Power Source||Power Supply|
|Redundant Power Supply Supported||Yes|
|Compatible Rack Unit||8U|
|Form Factor||Rack-mountable, Rail-mountable, Surface Mount|
Are you interested in these products? Welcome to learn details and check the price on Router-switch.com, and please feel free to check the the datasheets there.
Do you have any question about the price?