A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary command

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• arubanetworks aruba instant4.0 and later · before 4.2.4.12
• arubanetworks aruba instant6.5.0 and later · before 6.5.4.11
• arubanetworks aruba instant8.3.0.0 and later · before 8.3.0.6
• arubanetworks aruba instant8.4.0 and later · before 8.4.0.1
• siemens scalance w1750d firmwarebefore 8.4.0.1

Versions reported by the vendor

Affected version ranges reported by the assigning authority (hpe). Independent of NVD's CPE analysis and usually ahead of it.

• n/a Aruba Instant (IAP)

  • Aruba Instant 4.x prior to 6.4.4.8 - 4.2.4.12 Aruba Instant 6.5.x prior to 6.5.4.11 Aruba Instant 8.3.x prior to 8.3.0.6 Aruba Instant 8.4.x prior to 8.4.0.1affected

Other highest-scoring records for the same primary product.

• CVE-2021-37726A remote buffer overflow vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 8.7.x.x: 8.7.0.0 through 8.7.1.2.
  40Plan
• CVE-2018-7084A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute
  40Plan
• CVE-2018-7083If a process running within Aruba Instant crashes, it may leave behind a "core dump", which contains the memory contents of the process at t
  31Monitor
• CVE-2021-37732A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.
  29Monitor
• CVE-2021-37730A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.
  29Monitor
• CVE-2021-37727A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below
  29Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.