CVE-2023-45626 - CVE House

Status published Medium CVE-2023-45626

An authenticated vulnerability has been identified allowing an attacker to...

5.5 CVSS

Vulnerability Description

An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across boot cycles.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-45626

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Nicholas Starke of Aruba Threat Labs

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt

More from Hewlett Packard Enterprise (HPE)

View All →

CVE-2025-37186

Local Privilege Escalation Vulnerability in HPE Aruba Networking Virtual Intranet Access (VIA) Client for Linux

High 7.8

CVE-2025-37185

Authenticated Stored Cross-Site Scripting Vulnerabilities (XSS) in EdgeConnect SD-WAN Orchestrator Web Administration Interface

Medium 5.5

CVE-2025-37184

Unauthenticated Bypass Allows Multi-Factor Authentication Circumvention

Critical 9.8

CVE-2025-37183

Authenticated SQL Injection in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface

High 7.2

CVE-2025-37182

Authenticated SQL Injection in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface

High 7.2

Affected Vendor

Hewlett Packard Enterprise (HPE)

View all reports →

Affected Software

Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series;

Vulnerable Versions:

ArubaOS 10.5.x.x: 10.5.0.0 and below, ArubaOS 10.4.x.x: 10.4.0.2 and below, InstantOS 8.11.x.x: 8.11.1.2 and below, InstantOS 8.10.x.x: 8.10.0.8 and below, InstantOS 8.6.x.x: 8.6.0.22 and below

Timeline

Official Publish: November 14th, 2023

Last Modified: October 29th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.