Sunday, February 5, 2023
  • Events
  • Interviews
  • Jobs
  • Opinion
  • Whitepapers
  • Glossary
  • Community Forum
  • Web Hosting Directory
  • Login
  • Register
Cloud7 News
  • Cloud Computing
  • Web Hosting
  • Data Center
  • Linux
  • Cybersecurity
  • More
    • Network/Internet
    • Windows
    • Software
    • Hardware
    • Blockchain
    • Policy/Legislation
    • How-Tos
    • Troubleshooting
No Result
View All Result
Cloud7 News
  • Cloud Computing
  • Web Hosting
  • Data Center
  • Linux
  • Cybersecurity
  • More
    • Network/Internet
    • Windows
    • Software
    • Hardware
    • Blockchain
    • Policy/Legislation
    • How-Tos
    • Troubleshooting
No Result
View All Result
Cloud7 News
No Result
View All Result

Home > Cybersecurity > Aruba patches multiple critical vulnerabilities

Aruba patches multiple critical vulnerabilities

Aruba announced that the company has patched multiple vulnerabilities affecting its Aruba EdgeConnect Orchestrator.


Erdem Yasar Erdem Yasar
October 13, 2022
2 min read
Aruba patches multiple critical vulnerabilities
  • Aruba announced the release of patches that address multiple critical severity vulnerabilities impacting Aruba EdgeConnect Orchestrator.
  • Advisory states that the vulnerabilities can cause authentication bypass, which leads to a system takeover or unauthenticated remote code execution.
  • Aruba recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.

Aruba released a security advisory regarding various critical severity vulnerabilities impacting Aruba EdgeConnect Orchestrator. According to the advisory, the vulnerabilities can cause authentication bypass, which leads to a system takeover or unauthenticated remote code execution in Aruba EdgeConnect Enterprise Orchestrator Web-Based Management Interface.

System takeover

Two vulnerabilities, tracked as CVE-2022-37913 and CVE-2022-37914, were found in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator allowing attackers to bypass authentications. The overall CVSS score of these vulnerabilities is 9.8. Once exploited, it allows the attacker to gain administrative privileges leading to a complete compromise of the Aruba EdgeConnect Enterprise Orchestrator host.

Another vulnerability is a remote code execution in Aruba EdgeConnect Enterprise Orchestrator Web-Based Management Interface. The vulnerability, tracked as CVE-2022-37915, allows attackers to run arbitrary commands on the underlying host, which leads to complete system compromise.

According to the advisory, the affected products are:

  • Aruba EdgeConnect Enterprise Orchestrator (on-premises)
  • Aruba EdgeConnect Enterprise Orchestrator-as-a-Service
  • Aruba EdgeConnect Enterprise Orchestrator-SP and Aruba EdgeConnect Enterprise Orchestrator Global Enterprise Tenant Orchestrators
    • Orchestrator 9.1.2.40051 and below
    • Orchestrator 9.0.7.40108 and below
    • Orchestrator 8.10.23.40009 and below
    • Any older branches of Orchestrator not specifically mentioned

Users are urged to upgrade Aruba EdgeConnect Enterprise Orchestrator to one of the following versions with the fixes to resolve all issues:

  • Aruba EdgeConnect Enterprise Orchestrator (on-premises)
    • Orchestrator 9.2.0.40405 and above
    • Orchestrator 9.1.3.40197 and above
    • Orchestrator 9.0.7.40110 and above
    • Orchestrator 8.10.23.40015 and above
  • Aruba EdgeConnect Enterprise Orchestrator-as-a-Service
    • TAC will automatically create a support case for Aruba (Silver Peak) hosted Orchestrators to be upgraded.

Aruba also published a workaround for users to minimize the likelihood of an attacker exploiting these vulnerabilities. Aruba recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above.

See more Cybersecurity News


Tags: Aruba
Erdem Yasar

Erdem Yasar

Erdem Yasar is a news editor at Cloud7 News. Erdem started his career by writing video game reviews in 2007 for PC World magazine while he was studying computer engineering. In the following years, he focused on software development with various programming languages. After his graduation, he continued to work as an editor for several major tech-related websites and magazines. During the 2010s, Erdem Yasar shifted his focus to cloud computing, hosting, and data centers as they were becoming more popular topics in the tech industry. Erdem Yasar also worked with various industry-leading tech companies as a content creator by writing blog posts and other articles. Prior to his role at Cloud7 News, Erdem was the managing editor of T3 Magazine.

Next Post
VMware vCenter Server vulnerability still waiting for a patch after a year

VMware vCenter Server vulnerability still waiting for a patch after a year

Related News

LockBit encryptor source code is updated

LockBit encryptor source code is updated

February 3, 2023 4:40 pm
Fortinet is expanding its SOC offerings portfolio

Fortinet is expanding its SOC offerings portfolio

February 3, 2023 2:00 pm
Radware announces a new partner program

Radware announces a new partner program

February 3, 2023 1:30 pm
APTs are looking for developers to hire with hefty paychecks

APTs are looking for developers to hire with hefty paychecks

February 1, 2023 2:30 pm
Get free daily newsletters from Cloud7 News Get the Cloud7 Newsletter
Select list(s):

Check your inbox or spam folder to confirm your subscription.

By subscribing, you agree to our
Copyright Policy and Privacy Policy

Get the free newsletter

Subscribe to receive the latest IT business updates straight to your inbox.

Select list(s):

Check your inbox or spam folder to confirm your subscription.

Editor's Choice

What’s new in Linux kernel 6.2 rc6?

10 Best Web Hosting Services of 2023

Ubuntu 22.04 LTS is available for download. What is new?

CERN and Fermilab recommend AlmaLinux

7 best hosting control panels of 2023

How to update Linux Kernel without rebooting?

7 best Linux mail servers of 2023

7 best cPanel alternatives for 2023

7 best Linux web browsers for 2023

7 best CentOS alternatives

7 best Linux server distros of 2023

Interview with Igor Seletskiy on AlmaLinux

How to create a VM on VMware Workstation

Recent News

  • Weekly round-up: 30 January – 3 February
  • What is Deep Learning?
  • What is GitHub Copilot?
  • Cloud7 Expert Series: Dennis Kittrell from CloudLinux
  • Best Ubuntu alternatives for desktop of 2023

Cloud7 News
Cloud7 is a news source that publishes the latest news, reviews, comparisons, opinions, and exclusive interviews to help tech users of high-experience levels in the IT industry.

EXPLORE

  • Web Hosting
  • Cloud Computing
  • Data Center
  • Cybersecurity
  • Linux
  • Network/Internet
  • Software
  • Hardware
  • How-Tos
  • Troubleshooting

RESOURCES

  • Events
  • Interviews
  • Jobs
  • Opinion
  • Whitepapers
  • Glossary
  • Community Forum
  • Web Hosting Directory

Get the Cloud7 Newsletter

Get FREE daily newsletters from Cloud7 delivering the latest news and reviews.

  • About
  • Privacy & Policy
  • Copyright Policy
  • Contact

© 2023, Cloud7 News. All rights reserved.

No Result
View All Result
  • Cloud Computing
  • Web Hosting
  • Data Center
  • Linux
  • Cybersecurity
  • More
    • Network/Internet
    • Windows
    • Software
    • Hardware
    • Blockchain
    • Policy/Legislation
    • How-Tos
    • Troubleshooting
  • Events
  • Interviews
  • Jobs
  • Opinion
  • Whitepapers
  • Glossary
  • Community Forum
  • Web Hosting Directory

© 2023, Cloud7 News. All rights reserved.

Welcome Back!

Sign In with Facebook
Sign In with Google
Sign In with Linked In
OR

Login to your account below

Forgotten Password? Sign Up

Create New Account!

Sign Up with Facebook
Sign Up with Google
Sign Up with Linked In
OR

Fill the forms below to register

*By registering into our website, you agree to the Terms & Conditions and Privacy Policy.
All fields are required. Log In

Retrieve your password

Please enter your username or email address to reset your password.

Log In
This website uses cookies. By continuing to use this website you are giving consent to cookies being used. Visit our Privacy and Cookie Policy.