« Volver al listado

CVE-2018-7081

Estado: ModificadaCrítica (9.8)—

A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit specially-crafted IP traffic to a mobility controller could exploit this vulnerability and cause a process crash or to execute arbitrary code within the underlying operating system with full system privileges. Such an attack could lead to complete system compromise. The ability to transmit traffic to an IP interface on the mobility controller is required to carry out an attack. The attack leverages the PAPI protocol (UDP port 8211). If the mobility controller is only bridging L2 traffic to an uplink and does not have an IP address that is accessible to the attacker, it cannot be attacked.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Arubanetworks — Arubaos

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-7081",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-alert@hpe.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Aruba Mobility Controllers",
          "versions": [
            {
              "status": "affected",
              "version": "Aruba Mobility Controller firmware (ArubaOS) 6.x prior to 6.4.4.21 6.5.x prior to 6.5.4.13  8.x prior to 8.2.2.6  8.3.0.x prior to 8.3.0.7, 8.4.0.x and prior to 8.4.0.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-09-13T17:15:10.913",
  "references": [
    {
      "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-alert@hpe.com"
    },
    {
      "url": "https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security-alert@hpe.com"
    },
    {
      "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-004.txt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://x-c3ll.github.io/posts/CVE-2018-7081-RCE-ArubaOS/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacker with the ability to transmit specially-crafted IP traffic to a mobility controller could exploit this vulnerability and cause a process crash or to execute arbitrary code within the underlying operating system with full system privileges. Such an attack could lead to complete system compromise. The ability to transmit traffic to an IP interface on the mobility controller is required to carry out an attack. The attack leverages the PAPI protocol (UDP port 8211). If the mobility controller is only bridging L2 traffic to an uplink and does not have an IP address that is accessible to the attacker, it cannot be attacked."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de ejecución de código remota está presente en los componentes de escucha de red en algunas versiones de ArubaOS. Un atacante con la capacidad de transmitir tráfico IP especialmente diseñado hacia un controlador de movilidad podría explotar esta vulnerabilidad y causar un bloqueo del proceso o ejecutar código arbitrario dentro del sistema operativo subyacente con todos los privilegios del sistema. Tal y como un ataque podría conllevar a un compromiso total del sistema. La capacidad para transmitir tráfico hacia una interfaz IP en el controlador de movilidad es requerida para llevar a cabo un ataque. El ataque aprovecha el protocolo PAPI (puerto UDP 8211). Si el controlador de movilidad está solo conectando el tráfico L2 a un enlace ascendente y no tiene una dirección IP accesible para el atacante, no puede ser atacado."
    }
  ],
  "lastModified": "2026-06-17T02:02:38.407",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DDEB8052-8974-4F8B-9C64-DCE9D7C76753",
              "versionEndExcluding": "6.4.4.21"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16F5E9C2-A354-4F33-9D65-2A9FBDE6D085",
              "versionEndExcluding": "6.5.4.13",
              "versionStartIncluding": "6.5.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD6448CB-1D2B-47A4-9F70-0CDBE4F35858",
              "versionEndExcluding": "8.2.2.6",
              "versionStartIncluding": "8.0.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7F19B7F-1E7B-4C6E-AEB5-2755D10CA6CE",
              "versionEndExcluding": "8.3.0.7",
              "versionStartIncluding": "8.3.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5152AE7-9D5D-46D8-AC74-11CADDA2B366",
              "versionEndExcluding": "8.4.0.3",
              "versionStartIncluding": "8.4.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4420558-9318-4E4C-B607-952F2B9B95E3",
              "versionEndExcluding": "8.5.0.0",
              "versionStartIncluding": "8.4.0.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-alert@hpe.com"
}