CVE-2021-25141
Last modified
CVE-2021-25141 is a medium-severity vulnerability rated 4.4/10 on the CVSS scale. A security vulnerability has been identified in in certain HPE and Aruba L2/L3 switch firmware. A data processing error due to improper handling of an unexpected data type in user supplied information to the switch's management interface has been identified. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
A security vulnerability has been identified in in certain HPE and Aruba L2/L3 switch firmware. A data processing error due to improper handling of an unexpected data type in user supplied information to the switch's management interface has been identified. The data processing error could be exploited to cause a crash or reboot in the switch management interface and/or possibly the switch itself leading to local denial of service (DoS). The user must have administrator privileges to exploit this vulnerability.
Metrics
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Arubanetworks | Aruba 5406r Zl2 Firmware | < kb.16.10.0012 |
| Arubanetworks | Aruba 5412r Zl2 Firmware | < kb.16.10.0012 |
| Arubanetworks | Aruba 3810m Firmware | < kb.16.10.0012 |
| Arubanetworks | Aruba 2930m Firmware | < wc.16.10.0012 |
| Arubanetworks | Aruba 2930f Firmware | < wc.16.10.0012 |
| Arubanetworks | Aruba 2920 Firmware | < wb.16.10.0011 |
| Arubanetworks | Aruba 2540 Firmware | < yc.16.10.0012 |
| Arubanetworks | Aruba 2530ya Firmware | < ya.16.10.0012 |
| Arubanetworks | Aruba 3800 Firmware | < ka.16.04.0022 |
| Arubanetworks | Aruba 2620 Firmware | < ra.16.04.0022 |
| Hpe | 8200 Zl Firmware | < k.15.18.0024 |
| Hpe | 6200 Yl Firmware | < k.15.18.0024 |
| Hpe | 3500 Firmware | < k.16.02.0032 |
| Hpe | 3500 Yl Firmware | < k.16.02.0032 |
| Arubanetworks | Aruba 2530yb Firmware | < yb.16.10.0012 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-25141?
How severe is CVE-2021-25141?
How do I fix CVE-2021-25141?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-25135The Baseboard Management Controller(BMC) in HPE Cloudline CL…7.8
- CVE-2021-25136The Baseboard Management Controller(BMC) in HPE Cloudline CL…7.8
- CVE-2021-25137The Baseboard Management Controller(BMC) in HPE Cloudline CL…7.8
- CVE-2021-25138The Baseboard Management Controller(BMC) in HPE Cloudline CL…7.8
- CVE-2021-25139A potential security vulnerability has been identified in th…9.8
- CVE-2021-25140A potential security vulnerability has been identified in th…9.8
- CVE-2021-25142The Baseboard Management Controller (BMC) firmware in HPE Ap…7.8
- CVE-2021-25143A remote denial of service (dos) vulnerability was discovere…7.5
- CVE-2021-25144A remote buffer overflow vulnerability was discovered in som…8.8
- CVE-2021-25145A remote unauthorized disclosure of information vulnerabilit…6.5
- CVE-2021-25146A remote execution of arbitrary commands vulnerability was d…7.2
- CVE-2021-25147A remote authentication restriction bypass vulnerability was…8.1
Are you affected by CVE-2021-25141?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST