CVE-2021-29149
Last modified
CVE-2021-29149 is a medium-severity vulnerability rated 6.2/10 on the CVSS scale. A local bypass security restrictions vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): Aruba AOS-CX firmware: 10.04.xxxx - versions prior to 10.04.3070, 10.05.xxxx - versions prior to 10.05.0070, 10.06.xxxx - versions prior to 10.06.0110, 10.07.xxxx - versions prior to 10.07.0001. Aruba has released upgrades for Aruba AOS-CX devices that address this security vulnerability.. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
A local bypass security restrictions vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): Aruba AOS-CX firmware: 10.04.xxxx - versions prior to 10.04.3070, 10.05.xxxx - versions prior to 10.05.0070, 10.06.xxxx - versions prior to 10.06.0110, 10.07.xxxx - versions prior to 10.07.0001. Aruba has released upgrades for Aruba AOS-CX devices that address this security vulnerability.
Metrics
CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Arubanetworks | Aos-Cx Firmware | >= 10.04.000, < 10.04.3070 |
| Arubanetworks | Aos-Cx Firmware | >= 10.05.0000, < 10.05.0070 |
| Arubanetworks | Aos-Cx Firmware | >= 10.06.0000, <= 10.06.0110 |
| Arubanetworks | Aos-Cx Firmware | >= 10.07.0000, <= 10.07.0001 |
References
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-013.txtPatch, Vendor Advisory
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-013.txtPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-29149?
How severe is CVE-2021-29149?
How do I fix CVE-2021-29149?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-29143A remote execution of arbitrary commands vulnerability was d…7.2
- CVE-2021-29144A remote disclosure of sensitive information vulnerability w…6.5
- CVE-2021-29145A remote server side request forgery (SSRF) remote code exec…9.8
- CVE-2021-29146A remote cross-site scripting (XSS) vulnerability was discov…5.4
- CVE-2021-29147A remote arbitrary command execution vulnerability was disco…8.8
- CVE-2021-29148A local cross-site scripting (XSS) vulnerability was discove…6.1
- CVE-2021-29150A remote insecure deserialization vulnerability was discover…7.2
- CVE-2021-29151A remote authentication bypass vulnerability was discovered …4.3
- CVE-2021-29152A remote denial of service (DoS) vulnerability was discovere…6.5
- CVE-2021-29154BPF JIT compilers in the Linux kernel through 5.11.12 have i…7.8
- CVE-2021-29155An issue was discovered in the Linux kernel through 5.11.x. …5.5
- CVE-2021-29156ForgeRock OpenAM before 13.5.1 allows LDAP injection via the…7.5
Are you affected by CVE-2021-29149?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST