CVE-2023-3718
📋 TL;DR
CVE-2023-3718 is an authenticated command injection vulnerability in Aruba AOS-CX switches that allows attackers with CLI access to execute arbitrary commands as privileged users. This enables complete compromise of the underlying operating system on affected network devices. Organizations using vulnerable Aruba AOS-CX switches are affected.
💻 Affected Systems
- Aruba AOS-CX switches
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of network infrastructure, lateral movement to other systems, data exfiltration, persistent backdoors, and network disruption.
Likely Case
Unauthorized configuration changes, network monitoring, credential harvesting, and potential foothold for further attacks.
If Mitigated
Limited impact due to network segmentation, strong authentication controls, and restricted CLI access.
🎯 Exploit Status
Exploitation requires authenticated CLI access; command injection is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: AOS-CX 10.11.0000 and later
Vendor Advisory: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-010.txt
Restart Required: Yes
Instructions:
1. Download AOS-CX 10.11.0000 or later from Aruba support portal. 2. Backup current configuration. 3. Upload new firmware to switch. 4. Reboot switch to apply update. 5. Verify version with 'show version' command.
🔧 Temporary Workarounds
Restrict CLI Access
allLimit CLI access to trusted administrative accounts only using AAA controls.
aaa authentication login default local
aaa authorization exec default local
username admin privilege 15 secret yourpassword
Network Segmentation
allIsolate management interfaces from general network access.
interface mgmt
ip access-group MGMT-ACL in
🧯 If You Can't Patch
- Implement strict network segmentation for management interfaces
- Enforce multi-factor authentication and least privilege for CLI access
🔍 How to Verify
Check if Vulnerable:
Check AOS-CX version with 'show version' command; versions 10.10.x and earlier are vulnerable.Check Version:
show versionVerify Fix Applied:
Verify version is 10.11.0000 or later with 'show version' command.📡 Detection & Monitoring
Log Indicators:
- Unusual CLI command patterns
- Multiple failed authentication attempts followed by successful login
- Unexpected configuration changes
Network Indicators:
- Unusual outbound connections from switch management interface
- Unexpected SSH/Telnet sessions to switch
SIEM Query:
source="aruba-switch" AND (event_type="cli_command" AND command="*;*" OR command="*|*" OR command="*`*")