CVE-2023-35973
📋 TL;DR
Authenticated command injection vulnerabilities in ArubaOS CLI allow attackers with valid credentials to execute arbitrary commands as privileged users on the underlying OS. This affects Aruba networking devices running vulnerable versions of ArubaOS, potentially leading to full system compromise.
💻 Affected Systems
- ArubaOS
📦 What is this software?
Arubaos by Arubanetworks
Arubaos by Arubanetworks
Arubaos by Arubanetworks
Arubaos by Arubanetworks
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise, allowing attackers to steal sensitive data, disrupt network operations, or pivot to other systems.
Likely Case
Unauthorized command execution leading to configuration changes, data exfiltration, or installation of backdoors.
If Mitigated
Limited impact if strong access controls and network segmentation are in place, reducing exposure.
🎯 Exploit Status
Exploitation requires authenticated access to the CLI, making it straightforward for attackers with valid credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched versions.
Vendor Advisory: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
Restart Required: Yes
Instructions:
1. Review the vendor advisory for affected versions. 2. Download and apply the latest ArubaOS patch from Aruba support. 3. Restart the device to apply changes. 4. Verify the patch is installed successfully.
🔧 Temporary Workarounds
Restrict CLI Access
allLimit access to the CLI to trusted users and networks only.
Configure access control lists (ACLs) to restrict management interface access.
Disable Unnecessary CLI Features
allDisable or restrict CLI commands that are not required for operations.
Use ArubaOS configuration commands to disable unused CLI modules.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate management interfaces from untrusted networks.
- Enforce strong authentication and monitor for suspicious CLI activity.
🔍 How to Verify
Check if Vulnerable:
Check the ArubaOS version against the vendor advisory to see if it falls within the affected range.Check Version:
show versionVerify Fix Applied:
Verify the ArubaOS version has been updated to a patched version listed in the vendor advisory.📡 Detection & Monitoring
Log Indicators:
- Unusual CLI command executions, failed authentication attempts, or privilege escalation logs.
Network Indicators:
- Suspicious traffic to management interfaces, unexpected outbound connections from the device.
SIEM Query:
Example: search for 'ArubaOS CLI' events with command injection patterns or anomalous user activity.