« Volver al listado

CVE-2021-25161

Estado: ModificadaMedia (6.1)—

A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Arubanetworks — InstantSiemens — Scalance W1750d Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-25161",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-alert@hpe.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Aruba Instant Access Points",
          "versions": [
            {
              "status": "affected",
              "version": "Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below"
            },
            {
              "status": "affected",
              "version": "Aruba Instant 6.5.x: 6.5.4.18 and below"
            },
            {
              "status": "affected",
              "version": "Aruba Instant 8.3.x: 8.3.0.14 and below"
            },
            {
              "status": "affected",
              "version": "Aruba Instant 8.5.x: 8.5.0.11 and below"
            },
            {
              "status": "affected",
              "version": "Aruba Instant 8.6.x: 8.6.0.7 and below"
            },
            {
              "status": "affected",
              "version": "Aruba Instant 8.7.x: 8.7.1.1 and below"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-03-30T02:15:16.937",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security-alert@hpe.com"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-alert@hpe.com"
    },
    {
      "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-alert@hpe.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability."
    },
    {
      "lang": "es",
      "value": "Se detectó una vulnerabilidad de tipo cross-site scripting (xss) remota en algunos productos Aruba Instant Access Point (IAP) en versiones: Aruba Instant versiones 6.4.x: 6.4.4.8-4.2.4.17 y anteriores; Aruba Instant versiones 6.5.x: 6.5.4.18 y anteriores; Aruba Instant versiones 8.3.x: 8.3.0.14 y anteriores; Aruba Instant versiones 8.5.x: 8.5.0.11 y anteriores; Aruba Instant versiones 8.6.x: 8.6.0.7 y anteriores; Aruba Instant versiones 8.7.x: 8.7.1.1 y anteriores. Aruba ha lanzado parches para Aruba Instant que abordan esta vulnerabilidad de seguridad."
    }
  ],
  "lastModified": "2026-06-17T03:41:34.280",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60DB6954-B71C-4473-A746-7D8D588360A4",
              "versionEndIncluding": "6.4.4.8-4.2.4.18",
              "versionStartIncluding": "6.4.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "625B5BED-1E8C-434D-948B-A9C99A3A1336",
              "versionEndExcluding": "6.5.4.19",
              "versionStartIncluding": "6.5.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "429A4826-11FA-4E69-A006-97ECBD144D0F",
              "versionEndExcluding": "8.3.0.15",
              "versionStartIncluding": "8.3.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "76A177FA-BFBC-4E9E-AA2E-8FA49D66A06C",
              "versionEndExcluding": "8.5.0.12",
              "versionStartIncluding": "8.5.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D73052E-BA70-4DBC-8D23-8EF750AFB59B",
              "versionEndExcluding": "8.6.0.8",
              "versionStartIncluding": "8.6.0.0"
            },
            {
              "criteria": "cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F889114B-15B5-4224-8B58-179F33C4959B",
              "versionEndExcluding": "8.7.1.2",
              "versionStartIncluding": "8.7.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DDC134F8-5D6A-4D37-9BC7-CA0C772F8823",
              "versionEndExcluding": "8.7.1.3",
              "versionStartIncluding": "8.7.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:scalance_w1750d:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FBC30055-239F-4BB1-B2D1-E5E35F0D8911"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security-alert@hpe.com"
}