HPE patches eight maximum-severity ArubaOS flaws

Hewlett Packard Enterprise (HPE) has released security updates for 72 vulnerabilities in Aruba Operating System (ArubaOS), including eight maximum-severity flaws that allow authentication bypass or remote code execution.

ArubaOS powers Aruba Networking enterprise wireless equipment, including mobility conductors, access points, controllers and gateway devices. The eight flaws affect multiple AOS-8 and AOS-10 software versions. HPE says remote attackers could exploit them without privileges in low-complexity attacks that require no user interaction.

HPE urged customers to install the updates, citing the vulnerabilities’ complexity, breadth and impact. As a mitigation, the company recommends restricting command-line and web-based management interfaces to a dedicated Layer 2 segment or VLAN, or controlling access with firewall policies at Layer 3 and above. It also recommends accounting controls to track and log user activity and resource use.

HPE said it had found no publicly available proof-of-concept exploit code or evidence that the listed flaws were being exploited in the wild as of the advisory’s release. The company’s statement describes its awareness at that time; it does not establish whether exploitation has occurred since.