CVE-2021-41003 : Multiple unauthenticated command injection vulnerabilities were discovered in th

Multiple unauthenticated command injection vulnerabilities were discovered in the AOS-CX API interface in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): AOS-CX 10.06.xxxx: 10.06.0170 and below, AOS-CX 10.07.xxxx: 10.07.0050 and below, AOS-CX 10.08.xxxx: 10.08.1030 and below, AOS-CX 10.09.xxxx: 10.09.0002 and below. Aruba has released upgrades for Aruba AOS-CX devices that address these security vulnerabilities.

Published 2022-03-02 22:15:08

Updated 2022-09-27 17:16:48

Source Hewlett Packard Enterprise (HPE)

View at NVD, CVE.org

Products affected by CVE-2021-41003

HPE » Arubaos-cx
Versions from including (>=) 10.07.0001 and up to, including, (<=) 10.07.0050
cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » Aruba 8320 » Version: N/A
When used together with: HPE » Aruba 8325-32-c » Version: N/A
When used together with: HPE » Aruba 8325-48y8c » Version: N/A
When used together with: HPE » Aruba 8360-12c » Version: N/A
When used together with: HPE » Aruba 8360-16y2c » Version: N/A
When used together with: HPE » Aruba 8360-24xf2c » Version: N/A
When used together with: HPE » Aruba 8360-32y4c » Version: N/A
When used together with: HPE » Aruba 8360-48xt4c » Version: N/A
When used together with: HPE » Aruba 8400x » Version: N/A
When used together with: HPE » Aruba Cx 6200f » Version: N/A
When used together with: HPE » Aruba Cx 6300f » Version: N/A
When used together with: HPE » Aruba Cx 6300m » Version: N/A
When used together with: HPE » Aruba Cx 6405 » Version: N/A
When used together with: HPE » Aruba Cx 6410 » Version: N/A
HPE » Arubaos-cx
Versions from including (>=) 10.06.0001 and up to, including, (<=) 10.06.0170
cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » Aruba 8320 » Version: N/A
When used together with: HPE » Aruba 8325-32-c » Version: N/A
When used together with: HPE » Aruba 8325-48y8c » Version: N/A
When used together with: HPE » Aruba 8360-12c » Version: N/A
When used together with: HPE » Aruba 8360-16y2c » Version: N/A
When used together with: HPE » Aruba 8360-24xf2c » Version: N/A
When used together with: HPE » Aruba 8360-32y4c » Version: N/A
When used together with: HPE » Aruba 8360-48xt4c » Version: N/A
When used together with: HPE » Aruba 8400x » Version: N/A
When used together with: HPE » Aruba Cx 6200f » Version: N/A
When used together with: HPE » Aruba Cx 6300f » Version: N/A
When used together with: HPE » Aruba Cx 6300m » Version: N/A
When used together with: HPE » Aruba Cx 6405 » Version: N/A
When used together with: HPE » Aruba Cx 6410 » Version: N/A
HPE » Arubaos-cx
Versions from including (>=) 10.08.0001 and up to, including, (<=) 10.08.1030
cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » Aruba 8320 » Version: N/A
When used together with: HPE » Aruba 8325-32-c » Version: N/A
When used together with: HPE » Aruba 8325-48y8c » Version: N/A
When used together with: HPE » Aruba 8360-12c » Version: N/A
When used together with: HPE » Aruba 8360-16y2c » Version: N/A
When used together with: HPE » Aruba 8360-24xf2c » Version: N/A
When used together with: HPE » Aruba 8360-32y4c » Version: N/A
When used together with: HPE » Aruba 8360-48xt4c » Version: N/A
When used together with: HPE » Aruba 8400x » Version: N/A
When used together with: HPE » Aruba Cx 6200f » Version: N/A
When used together with: HPE » Aruba Cx 6300f » Version: N/A
When used together with: HPE » Aruba Cx 6300m » Version: N/A
When used together with: HPE » Aruba Cx 6405 » Version: N/A
When used together with: HPE » Aruba Cx 6410 » Version: N/A
HPE » Arubaos-cx
Versions from including (>=) 10.09.0001 and up to, including, (<=) 10.09.0002
cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » Aruba 8320 » Version: N/A
When used together with: HPE » Aruba 8325-32-c » Version: N/A
When used together with: HPE » Aruba 8325-48y8c » Version: N/A
When used together with: HPE » Aruba 8360-12c » Version: N/A
When used together with: HPE » Aruba 8360-16y2c » Version: N/A
When used together with: HPE » Aruba 8360-24xf2c » Version: N/A
When used together with: HPE » Aruba 8360-32y4c » Version: N/A
When used together with: HPE » Aruba 8360-48xt4c » Version: N/A
When used together with: HPE » Aruba 8400x » Version: N/A
When used together with: HPE » Aruba Cx 6200f » Version: N/A
When used together with: HPE » Aruba Cx 6300f » Version: N/A
When used together with: HPE » Aruba Cx 6300m » Version: N/A
When used together with: HPE » Aruba Cx 6405 » Version: N/A
When used together with: HPE » Aruba Cx 6410 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2021-41003

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 32 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-41003

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

References for CVE-2021-41003

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt

Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-41003

Products affected by CVE-2021-41003

Exploit prediction scoring system (EPSS) score for CVE-2021-41003

CVSS scores for CVE-2021-41003

References for CVE-2021-41003