CVE-2021-37722
📋 TL;DR
This CVE allows remote attackers to execute arbitrary commands on Aruba SD-WAN and gateway devices through improper neutralization of special elements used in a command. Affected organizations include those running vulnerable ArubaOS versions on SD-WAN software and gateways.
💻 Affected Systems
- Aruba SD-WAN Software
- Aruba Gateways
📦 What is this software?
Arubaos by Arubanetworks
Arubaos by Arubanetworks
Arubaos by Arubanetworks
Arubaos by Arubanetworks
Arubaos by Arubanetworks
Arubaos by Arubanetworks
Sd Wan by Arubanetworks
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to gain persistent access, pivot to internal networks, deploy ransomware, or exfiltrate sensitive data.
Likely Case
Attackers gain initial foothold on network infrastructure, enabling lateral movement, credential harvesting, and deployment of additional malware.
If Mitigated
Attack prevented at perimeter with proper network segmentation, reducing impact to isolated network segments.
🎯 Exploit Status
Vulnerability allows remote command execution without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.6.0.4-2.2.0.4 or later; 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25 or later
Vendor Advisory: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txt
Restart Required: Yes
Instructions:
1. Download appropriate patch from Aruba support portal. 2. Backup current configuration. 3. Apply patch following Aruba's upgrade procedures. 4. Reboot device. 5. Verify patch installation and functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate vulnerable devices from internet and restrict access to management interfaces
Access Control Lists
allImplement strict ACLs to limit access to management interfaces
🧯 If You Can't Patch
- Immediately isolate affected devices from internet-facing networks
- Implement strict network segmentation and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check ArubaOS version via CLI: 'show version' and compare against affected versionsCheck Version:
show versionVerify Fix Applied:
Verify version after patch: 'show version' should show patched version📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Unauthorized configuration changes
- Suspicious login attempts
Network Indicators:
- Unexpected outbound connections from management interfaces
- Anomalous traffic patterns from gateways
SIEM Query:
source="aruba_logs" AND (event_type="command_execution" OR event_type="config_change")