CVE-2023-1168 - Vulnerability Details

Vendors	Products
Hpe	Aruba Cx 10000-48y6 Aruba Cx 6200f 48g Aruba Cx 6200m 24g Aruba Cx 6300m 24p Aruba Cx 6300m 48g Aruba Cx 6405 Aruba Cx 6410 Aruba Cx 8320-32 Aruba Cx 8320-48p Aruba Cx 8325-32c Aruba Cx 8325-48y8c Aruba Cx 8360-12c Aruba Cx 8360-16y2c Aruba Cx 8360-24xf2c Aruba Cx 8360-32y4c Aruba Cx 8360-48xt4c Aruba Cx 8360-48y6c Aruba Cx 8400 Aruba Cx 9300 32d Arubaos-cx

Link	Providers
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-004.txt

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Weaknesses		CWE-77

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-1168", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2023-03-03T16:58:46.073Z", "datePublished": "2023-03-21T20:22:09.558Z", "dateUpdated": "2025-02-26T16:33:03.782Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["AOS-CX"], "product": "Aruba CX 10000 Switch Series, Aruba CX 9300 Switch Series, Aruba CX 8400 Switch Series, Aruba CX 8360 Switch Series, Aruba CX 8325 Switch Series, Aruba CX 8320 Switch Series, Aruba CX 6400 Switch Series, Aruba CX 6300 Switch Series, Aruba CX 6200F Switch Series", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"status": "affected", "version": "AOS-CX 10.10.xxxx: 10.10.1020 and below."}, {"status": "affected", "version": "AOS-CX 10.09.xxxx: 10.09.1020 and below."}, {"status": "affected", "version": "AOS-CX 10.08.xxxx: 10.08.1070 and below."}, {"status": "affected", "version": "AOS-CX 10.06.xxxx: 10.06.0230 and below."}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Daniel Jensen (@dozernz)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An authenticated remote code execution vulnerability\n    exists in the AOS-CX Network Analytics Engine. Successful\n    exploitation of this vulnerability results in the ability to\n    execute arbitrary code as a privileged user on the underlying\n    operating system, leading to a complete compromise of the\n    switch running AOS-CX.<br><br><br>"}], "value": "An authenticated remote code execution vulnerability\n    exists in the AOS-CX Network Analytics Engine. Successful\n    exploitation of this vulnerability results in the ability to\n    execute arbitrary code as a privileged user on the underlying\n    operating system, leading to a complete compromise of the\n    switch running AOS-CX.\n\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2023-03-22T04:38:44.935Z"}, "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-004.txt"}], "source": {"discovery": "INTERNAL"}, "title": "Authenticated Remote Code Execution in Aruba CX Switches", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:40:57.963Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-004.txt", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-26T16:29:51.845138Z", "id": "CVE-2023-1168", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-26T16:33:03.782Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-1168 (string)

assignerOrgId : eb103674-0d28-4225-80f8-39fb86215de0 (string)

state : PUBLISHED (string)

assignerShortName : hpe (string)

dateReserved : 2023-03-03T16:58:46.073Z (string)

datePublished : 2023-03-21T20:22:09.558Z (string)

dateUpdated : 2025-02-26T16:33:03.782Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

platforms : [ »

0 : AOS-CX (string)

]

product : Aruba CX 10000 Switch Series, Aruba CX 9300 Switch Series, Aruba CX 8400 Switch Series, Aruba CX 8360 Switch Series, Aruba CX 8325 Switch Series, Aruba CX 8320 Switch Series, Aruba CX 6400 Switch Series, Aruba CX 6300 Switch Series, Aruba CX 6200F Switch Series (string)

vendor : Hewlett Packard Enterprise (HPE) (string)

versions : [ »

0 : { »

status : affected (string)

version : AOS-CX 10.10.xxxx: 10.10.1020 and below. (string)

}

1 : { »

status : affected (string)

version : AOS-CX 10.09.xxxx: 10.09.1020 and below. (string)

}

2 : { »

status : affected (string)

version : AOS-CX 10.08.xxxx: 10.08.1070 and below. (string)

}

3 : { »

status : affected (string)

version : AOS-CX 10.06.xxxx: 10.06.0230 and below. (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : Daniel Jensen (@dozernz) (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system, leading to a complete compromise of the switch running AOS-CX. (string)

}

]

value : An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system, leading to a complete compromise of the switch running AOS-CX. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.2 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

providerMetadata : { »

orgId : eb103674-0d28-4225-80f8-39fb86215de0 (string)

shortName : hpe (string)

dateUpdated : 2023-03-22T04:38:44.935Z (string)

}

references : [ »

0 : { »

url : https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-004.txt (string)

}

]

source : { »

discovery : INTERNAL (string)

}

title : Authenticated Remote Code Execution in Aruba CX Switches (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : n/a (string)

lang : en (string)

type : text (string)

}

]

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T05:40:57.963Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-004.txt (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-77 (string)

lang : en (string)

description : CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-02-26T16:29:51.845138Z (string)

id : CVE-2023-1168 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-02-26T16:33:03.782Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-1168", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2023-03-03T16:58:46.073Z", "datePublished": "2023-03-21T20:22:09.558Z", "dateUpdated": "2025-02-26T16:33:03.782Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["AOS-CX"], "product": "Aruba CX 10000 Switch Series, Aruba CX 9300 Switch Series, Aruba CX 8400 Switch Series, Aruba CX 8360 Switch Series, Aruba CX 8325 Switch Series, Aruba CX 8320 Switch Series, Aruba CX 6400 Switch Series, Aruba CX 6300 Switch Series, Aruba CX 6200F Switch Series", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"status": "affected", "version": "AOS-CX 10.10.xxxx: 10.10.1020 and below."}, {"status": "affected", "version": "AOS-CX 10.09.xxxx: 10.09.1020 and below."}, {"status": "affected", "version": "AOS-CX 10.08.xxxx: 10.08.1070 and below."}, {"status": "affected", "version": "AOS-CX 10.06.xxxx: 10.06.0230 and below."}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Daniel Jensen (@dozernz)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An authenticated remote code execution vulnerability\n    exists in the AOS-CX Network Analytics Engine. Successful\n    exploitation of this vulnerability results in the ability to\n    execute arbitrary code as a privileged user on the underlying\n    operating system, leading to a complete compromise of the\n    switch running AOS-CX.<br><br><br>"}], "value": "An authenticated remote code execution vulnerability\n    exists in the AOS-CX Network Analytics Engine. Successful\n    exploitation of this vulnerability results in the ability to\n    execute arbitrary code as a privileged user on the underlying\n    operating system, leading to a complete compromise of the\n    switch running AOS-CX.\n\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2023-03-22T04:38:44.935Z"}, "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-004.txt"}], "source": {"discovery": "INTERNAL"}, "title": "Authenticated Remote Code Execution in Aruba CX Switches", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:40:57.963Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-004.txt", "tags": ["x_transferred"]}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-1168", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-26T16:29:51.845138Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-26T16:32:53.428Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-1168 (string)

assignerOrgId : eb103674-0d28-4225-80f8-39fb86215de0 (string)

state : PUBLISHED (string)

assignerShortName : hpe (string)

dateReserved : 2023-03-03T16:58:46.073Z (string)

datePublished : 2023-03-21T20:22:09.558Z (string)

dateUpdated : 2025-02-26T16:33:03.782Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

platforms : [ »

0 : AOS-CX (string)

]

product : Aruba CX 10000 Switch Series, Aruba CX 9300 Switch Series, Aruba CX 8400 Switch Series, Aruba CX 8360 Switch Series, Aruba CX 8325 Switch Series, Aruba CX 8320 Switch Series, Aruba CX 6400 Switch Series, Aruba CX 6300 Switch Series, Aruba CX 6200F Switch Series (string)

vendor : Hewlett Packard Enterprise (HPE) (string)

versions : [ »

0 : { »

status : affected (string)

version : AOS-CX 10.10.xxxx: 10.10.1020 and below. (string)

}

1 : { »

status : affected (string)

version : AOS-CX 10.09.xxxx: 10.09.1020 and below. (string)

}

2 : { »

status : affected (string)

version : AOS-CX 10.08.xxxx: 10.08.1070 and below. (string)

}

3 : { »

status : affected (string)

version : AOS-CX 10.06.xxxx: 10.06.0230 and below. (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : Daniel Jensen (@dozernz) (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system, leading to a complete compromise of the switch running AOS-CX. (string)

}

]

value : An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system, leading to a complete compromise of the switch running AOS-CX. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.2 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

providerMetadata : { »

orgId : eb103674-0d28-4225-80f8-39fb86215de0 (string)

shortName : hpe (string)

dateUpdated : 2023-03-22T04:38:44.935Z (string)

}

references : [ »

0 : { »

url : https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-004.txt (string)

}

]

source : { »

discovery : INTERNAL (string)

}

title : Authenticated Remote Code Execution in Aruba CX Switches (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : n/a (string)

lang : en (string)

type : text (string)

}

]

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T05:40:57.963Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-004.txt (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-1168 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-02-26T16:29:51.845138Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-77 (string)

description : CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-02-26T16:32:53.428Z (string)

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", "matchCriteriaId": "93B17071-FD9B-49C1-8C0B-FDA68664E773", "versionEndExcluding": "10.06.0240", "versionStartIncluding": "10.06.0000", "vulnerable": true}, {"criteria": "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", "matchCriteriaId": "6C8A631C-CB1E-4314-943D-713DC9EA260E", "versionEndIncluding": "10.08.1070", "versionStartIncluding": "10.08.0000", "vulnerable": true}, {"criteria": "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", "matchCriteriaId": "936EB0DA-9A69-4E7B-B5F5-437A86B8C897", "versionEndIncluding": "10.09.1020", "versionStartIncluding": "10.09.0000", "vulnerable": true}, {"criteria": "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", "matchCriteriaId": "690D819F-1B6E-48A1-BEDD-90B511048317", "versionEndExcluding": "10.10.1030", "versionStartIncluding": "10.10.0000", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:hpe:aruba_cx_10000-48y6:-:*:*:*:*:*:*:*", "matchCriteriaId": "D10D4824-3D75-4CD2-A541-D910B91FD560", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_6200f_48g:-:*:*:*:*:*:*:*", "matchCriteriaId": "F9BC4F4F-5DF6-45D6-9039-BF06C5D53487", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_6200m_24g:-:*:*:*:*:*:*:*", "matchCriteriaId": "D05337A1-9022-41DA-AFED-AE76FC39D3C6", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_6300m_24p:-:*:*:*:*:*:*:*", "matchCriteriaId": "5172FB6C-C38E-4A5A-8C67-55B475C96B0A", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_6300m_48g:-:*:*:*:*:*:*:*", "matchCriteriaId": "3FF6C6CE-E842-420D-9C4C-54D4B4F85D14", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_6405:-:*:*:*:*:*:*:*", "matchCriteriaId": "D118A9A6-BBA4-4149-AE0D-1DA2EB45B53F", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_6410:-:*:*:*:*:*:*:*", "matchCriteriaId": "790C5E7A-3405-4873-83E8-4D9C0FEC5E6D", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_8320-32:-:*:*:*:*:*:*:*", "matchCriteriaId": "873275E0-0BF3-42A6-A88A-4A4CDCC98C37", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_8320-48p:-:*:*:*:*:*:*:*", "matchCriteriaId": "65875CB1-A9A3-42CC-A14D-7AB4E985808A", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_8325-32c:-:*:*:*:*:*:*:*", "matchCriteriaId": "59B7E2D3-0B72-4A78-AEFA-F106FAD38156", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_8325-48y8c:-:*:*:*:*:*:*:*", "matchCriteriaId": "7E87A92B-4EE5-4235-A0DA-195F27841DBB", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_8360-12c:-:*:*:*:*:*:*:*", "matchCriteriaId": "6BC24E52-13C0-402F-9ABF-A1DE51719AEF", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_8360-16y2c:-:*:*:*:*:*:*:*", "matchCriteriaId": "76EF979E-061A-42A3-B161-B835E92ED180", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_8360-24xf2c:-:*:*:*:*:*:*:*", "matchCriteriaId": "DE04919C-9289-4FB3-938F-F8BB15EC6A74", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_8360-32y4c:-:*:*:*:*:*:*:*", "matchCriteriaId": "B630C64B-C474-477D-A80B-A0FB73ACCC49", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_8360-48xt4c:-:*:*:*:*:*:*:*", "matchCriteriaId": "53ABE8B8-A4F6-400B-A893-314BE24D06B8", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_8360-48y6c:-:*:*:*:*:*:*:*", "matchCriteriaId": "C44383CC-3751-455E-B1AB-39B16F40DC76", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_8400:-:*:*:*:*:*:*:*", "matchCriteriaId": "B25A9CD2-5E5F-4BDB-8707-5D6941411A2B", "vulnerable": false}, {"criteria": "cpe:2.3:h:hpe:aruba_cx_9300_32d:-:*:*:*:*:*:*:*", "matchCriteriaId": "6C595A15-BD04-45A3-A719-3DFB8DAB46E7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authenticated remote code execution vulnerability\n    exists in the AOS-CX Network Analytics Engine. Successful\n    exploitation of this vulnerability results in the ability to\n    execute arbitrary code as a privileged user on the underlying\n    operating system, leading to a complete compromise of the\n    switch running AOS-CX.\n\n\n"}], "id": "CVE-2023-1168", "lastModified": "2025-02-26T17:15:14.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security-alert@hpe.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-03-22T06:15:09.390", "references": [{"source": "security-alert@hpe.com", "tags": ["Vendor Advisory"], "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-004.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-004.txt"}], "sourceIdentifier": "security-alert@hpe.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-77"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 93B17071-FD9B-49C1-8C0B-FDA68664E773 (string)

versionEndExcluding : 10.06.0240 (string)

versionStartIncluding : 10.06.0000 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 6C8A631C-CB1E-4314-943D-713DC9EA260E (string)

versionEndIncluding : 10.08.1070 (string)

versionStartIncluding : 10.08.0000 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 936EB0DA-9A69-4E7B-B5F5-437A86B8C897 (string)

versionEndIncluding : 10.09.1020 (string)

versionStartIncluding : 10.09.0000 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 690D819F-1B6E-48A1-BEDD-90B511048317 (string)

versionEndExcluding : 10.10.1030 (string)

versionStartIncluding : 10.10.0000 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_10000-48y6:-:*:*:*:*:*:*:* (string)

matchCriteriaId : D10D4824-3D75-4CD2-A541-D910B91FD560 (string)

vulnerable : false (boolean)

}

1 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_6200f_48g:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F9BC4F4F-5DF6-45D6-9039-BF06C5D53487 (string)

vulnerable : false (boolean)

}

2 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_6200m_24g:-:*:*:*:*:*:*:* (string)

matchCriteriaId : D05337A1-9022-41DA-AFED-AE76FC39D3C6 (string)

vulnerable : false (boolean)

}

3 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_6300m_24p:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 5172FB6C-C38E-4A5A-8C67-55B475C96B0A (string)

vulnerable : false (boolean)

}

4 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_6300m_48g:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 3FF6C6CE-E842-420D-9C4C-54D4B4F85D14 (string)

vulnerable : false (boolean)

}

5 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_6405:-:*:*:*:*:*:*:* (string)

matchCriteriaId : D118A9A6-BBA4-4149-AE0D-1DA2EB45B53F (string)

vulnerable : false (boolean)

}

6 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_6410:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 790C5E7A-3405-4873-83E8-4D9C0FEC5E6D (string)

vulnerable : false (boolean)

}

7 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_8320-32:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 873275E0-0BF3-42A6-A88A-4A4CDCC98C37 (string)

vulnerable : false (boolean)

}

8 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_8320-48p:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 65875CB1-A9A3-42CC-A14D-7AB4E985808A (string)

vulnerable : false (boolean)

}

9 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_8325-32c:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 59B7E2D3-0B72-4A78-AEFA-F106FAD38156 (string)

vulnerable : false (boolean)

}

10 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_8325-48y8c:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 7E87A92B-4EE5-4235-A0DA-195F27841DBB (string)

vulnerable : false (boolean)

}

11 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_8360-12c:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 6BC24E52-13C0-402F-9ABF-A1DE51719AEF (string)

vulnerable : false (boolean)

}

12 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_8360-16y2c:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 76EF979E-061A-42A3-B161-B835E92ED180 (string)

vulnerable : false (boolean)

}

13 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_8360-24xf2c:-:*:*:*:*:*:*:* (string)

matchCriteriaId : DE04919C-9289-4FB3-938F-F8BB15EC6A74 (string)

vulnerable : false (boolean)

}

14 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_8360-32y4c:-:*:*:*:*:*:*:* (string)

matchCriteriaId : B630C64B-C474-477D-A80B-A0FB73ACCC49 (string)

vulnerable : false (boolean)

}

15 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_8360-48xt4c:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 53ABE8B8-A4F6-400B-A893-314BE24D06B8 (string)

vulnerable : false (boolean)

}

16 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_8360-48y6c:-:*:*:*:*:*:*:* (string)

matchCriteriaId : C44383CC-3751-455E-B1AB-39B16F40DC76 (string)

vulnerable : false (boolean)

}

17 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_8400:-:*:*:*:*:*:*:* (string)

matchCriteriaId : B25A9CD2-5E5F-4BDB-8707-5D6941411A2B (string)

vulnerable : false (boolean)

}

18 : { »

criteria : cpe:2.3:h:hpe:aruba_cx_9300_32d:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 6C595A15-BD04-45A3-A719-3DFB8DAB46E7 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system, leading to a complete compromise of the switch running AOS-CX. (string)

}

]

id : CVE-2023-1168 (string)

lastModified : 2025-02-26T17:15:14.790 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.2 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 5.9 (number)

source : security-alert@hpe.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-03-22T06:15:09.390 (string)

references : [ »

0 : { »

source : security-alert@hpe.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-004.txt (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-004.txt (string)

}

]

sourceIdentifier : security-alert@hpe.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-77 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object