CVE-2023-38486
Last modified
CVE-2023-38486 is a medium-severity vulnerability rated 6.4/10 on the CVSS scale. A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypass security controls which would normally prohibit unsigned kernel images from executing. An attacker can use this vulnerability to execute arbitrary runtime operating systems, including unverified and unsigned OS images.. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypass security controls which would normally prohibit unsigned kernel images from executing. An attacker can use this vulnerability to execute arbitrary runtime operating systems, including unverified and unsigned OS images.
Metrics
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Arubanetworks | Arubaos | >= 8.6.0.0, < 8.6.0.22 |
| Arubanetworks | Arubaos | >= 8.10.0.0, < 8.10.0.7 |
| Arubanetworks | Arubaos | >= 8.11.0.0, < 8.11.1.1 |
| Arubanetworks | Arubaos | >= 10.4.0.0, < 10.4.0.2 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-38486?
How severe is CVE-2023-38486?
How do I fix CVE-2023-38486?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-38480Missing Authorization vulnerability in Certain Dev Booster E…5.3
- CVE-2023-38481URL Redirection to Untrusted Site ('Open Redirect') vulnerab…6.1
- CVE-2023-38482Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
- CVE-2023-38483Missing Authorization vulnerability in Dylan Blokhuis Instan…5.4
- CVE-2023-38484Vulnerabilities exist in the BIOS implementation of Aruba 92…6.4
- CVE-2023-38485Vulnerabilities exist in the BIOS implementation of Aruba 92…6.4
- CVE-2023-38487HedgeDoc is software for creating real-time collaborative ma…8.2
- CVE-2023-38488Kirby is a content management system. A vulnerability in ver…8.8
- CVE-2023-38489Kirby is a content management system. A vulnerability in ver…7.3
- CVE-2023-3849A vulnerability, which was classified as problematic, was fo…6.1
- CVE-2023-38490Kirby is a content management system. A vulnerability in ver…10
- CVE-2023-38491Kirby is a content management system. A vulnerability in ver…5.4
Are you affected by CVE-2023-38486?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST