CVE-2021-37718
📋 TL;DR
This CVE allows remote attackers to execute arbitrary commands on affected Aruba SD-WAN and gateway devices. The vulnerability stems from improper neutralization of special elements used in a command (CWE-77), enabling attackers to run malicious code with system privileges. Organizations using Aruba SD-WAN Software, Gateways, or ArubaOS before the patched versions are affected.
💻 Affected Systems
- Aruba SD-WAN Software
- Aruba Gateways
- ArubaOS
📦 What is this software?
Arubaos by Arubanetworks
Arubaos by Arubanetworks
Arubaos by Arubanetworks
Arubaos by Arubanetworks
Sd Wan by Arubanetworks
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of affected devices, allowing attackers to install persistent backdoors, pivot to internal networks, exfiltrate sensitive data, or disrupt network operations.
Likely Case
Attackers gain unauthorized access to network infrastructure, potentially intercepting traffic, modifying configurations, or launching further attacks against internal systems.
If Mitigated
With proper network segmentation and access controls, impact is limited to the affected device itself, though it still represents a significant security breach.
🎯 Exploit Status
The vulnerability allows remote command execution without authentication, making it highly attractive to attackers. While no public proof-of-concept exists, similar command injection vulnerabilities are frequently weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ArubaOS 8.6.0.4-2.2.0.6 or later; 8.7.1.4, 8.6.0.7, 8.5.0.12, 8.3.0.16 or later
Vendor Advisory: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt
Restart Required: Yes
Instructions:
1. Download the appropriate patched version from Aruba support portal. 2. Backup current configuration. 3. Apply the update following Aruba's upgrade procedures. 4. Reboot the device. 5. Verify the new version is running.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to affected devices to only trusted management networks
Firewall Rules
allImplement strict firewall rules to block unnecessary inbound connections to management interfaces
🧯 If You Can't Patch
- Isolate affected devices in a dedicated network segment with strict access controls
- Implement network monitoring and intrusion detection specifically for traffic to/from affected devices
🔍 How to Verify
Check if Vulnerable:
Check ArubaOS version via CLI: 'show version' and compare against affected versionsCheck Version:
show versionVerify Fix Applied:
After patching, run 'show version' to confirm version matches patched releases📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Unexpected configuration changes
- Authentication failures followed by successful access
Network Indicators:
- Unusual outbound connections from network devices
- Traffic patterns inconsistent with normal operations
- Unexpected management protocol traffic
SIEM Query:
source="aruba_device" AND (event_type="command_execution" OR config_change="true")