New Vulnerabilities in HPE Aruba Networking Require Urgent Patching

On October 22, HPE Aruba Networking published a number of security bulletins regarding vulnerabilities in ArubaOS and ClearPass. Aranya recommends that affected organizations promptly identify the affected systems and schedule patching in accordance with HPE’s recommendations. These measures should be prioritized based on the systems’ exposure and the risk the vulnerabilities pose to the specific environment.

Special attention should be paid to environments where ClearPass is used for guest registration. If immediate patching is not possible, we recommend disabling access to the guest portal until the vulnerabilities have been addressed. Administrative access to the affected products should also be restricted through network segmentation.

The current vulnerabilities are listed below:

HPESBNW05162 – Vulnerabilities in ArubaOS (AOS-8 and AOS-10)
The security bulletin covers several vulnerabilities affecting both controllers/gateways and access points (APs).
Several of the vulnerabilities are classified as critical and, in some cases, can be exploited without authentication. The vulnerabilities in ArubaOS are largely unrelated to the previously reported PHP vulnerabilities and instead affect various functions and Services within ArubaOS.

HPESBNW05171 – Vulnerabilities in ClearPass (6.11 and 6.14)
The security bulletin addresses several vulnerabilities in ClearPass 6.11 and 6.14. Please note that ClearPass 6.12 is no longer supported and is therefore not covered by the security bulletin’s version reporting, although this version may also be vulnerable.
Several of the vulnerabilities are classified as critical and can in some cases be exploited without authentication. Unlike the vulnerabilities in ArubaOS, the vulnerabilities in ClearPass are linked to previously reported PHP vulnerabilities and affect, among other things, the guest portal and administrative interfaces.