A vulnerability exists in the firmware of embedded BLE radios that are part of some Aruba Access points.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• arubanetworks 203r firmwareall versions
• arubanetworks 203rp firmwareall versions
• arubanetworks ap-300 series access points firmwareall versions
• arubanetworks ap-300 series instant access points firmwareall versions
• arubanetworks arubaos6.4.4.0 and later · before 6.4.4.20
• arubanetworks arubaos8.3.0.0 and later · before 8.3.0.4
• arubanetworks arubaos6.5.3.0 and later · before 6.5.3.9
• arubanetworks arubaos6.5.4.0 and later · before 6.5.4.9
• arubanetworks arubaos8.0.0.0 and later · before 8.2.2.2

Versions reported by the vendor

Affected version ranges reported by the assigning authority (hpe). Independent of NVD's CPE analysis and usually ahead of it.

• Hewlett Packard Enterprise Aruba Access Points

  • AP-3xx and IAP-3xx series access points, AP-203R, AP-203RP, ArubaOS 6.4.4.x prior to 6.4.4.20, ArubaOS 6.5.3.x prior to 6.5.3.9, ArubaOS 6.5.4.x prior to 6.5.4.9, ArubaOS 8.x prior to 8.2.2.2, ArubaOSaffected

Other highest-scoring records for the same primary product.

• CVE-2020-24633There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending especially crafted pa
  41Plan
• CVE-2018-7081A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS.
  41Plan
• CVE-2023-45616There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution b
  40Plan
• CVE-2023-45615There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending
  40Plan
• CVE-2023-45614There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending
  40Plan
• CVE-2023-35982Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.