A remotely exploitable information disclosure vulnerability is present in Aruba…
Priority LOW 35Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A remotely exploitable information disclosure vulnerability is present in Aruba Intelligent Edge Switch models 5400, 3810, 2920, 2930, 2530 with GigT port, 2530 10/100 port, or 2540. The vulnerability impacts firmware 16.08.* before 16.08.0009, 16.09.* before 16.09.0007 and 16.10.* before 16.10.0003. The vulnerability allows an attacker to retrieve sensitive system information. This attack can be carried out without user authentication under very specific conditions.
Why it matters now
EPSS 0.01162 67th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Aruba Intelligent Edge Switch 5400 3810 2920 2930 2530 with GigT port 2530 10/100 port or 2540 | all versions | — | No fix listed | CNA |
- Aruba Intelligent Edge Switch 5400 3810 2920 2930 2530 with GigT port 2530 10/100 port or 2540 Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:arubanetworks:5400r_firmware:*:*:*:*:*:*:*:* | 16.08.0 to before 16.08.0009; 16.09.0 to before 16.09.0007; 16.10.0 to before 16.10.0003 | Vulnerable | Arubanetworks |
| cpe:2.3:h:arubanetworks:5400r:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Arubanetworks |
| cpe:2.3:o:arubanetworks:3810_firmware:*:*:*:*:*:*:*:* | 16.08.0 to before 16.08.0009; 16.09.0 to before 16.09.0007; 16.10.0 to before 16.10.0003 | Vulnerable | Arubanetworks |
| cpe:2.3:h:arubanetworks:3810:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Arubanetworks |
| cpe:2.3:o:arubanetworks:2920_firmware:*:*:*:*:*:*:*:* | 16.08.0 to before 16.08.0009; 16.09.0 to before 16.09.0007; 16.10.0 to before 16.10.0003 | Vulnerable | Arubanetworks |
| cpe:2.3:h:arubanetworks:2920:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Arubanetworks |
| cpe:2.3:o:arubanetworks:2930_firmware:*:*:*:*:*:*:*:* | 16.08.0 to before 16.08.0009; 16.09.0 to before 16.09.0007; 16.10.0 to before 16.10.0003 | Vulnerable | Arubanetworks |
| cpe:2.3:h:arubanetworks:2930:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Arubanetworks |
| cpe:2.3:o:arubanetworks:2530_with_gigt_port_firmware:*:*:*:*:*:*:*:* | 16.08.0 to before 16.08.0009; 16.09.0 to before 16.09.0007; 16.10.0 to before 16.10.0003 | Vulnerable | Arubanetworks |
| cpe:2.3:h:arubanetworks:2530_with_gigt_port:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Arubanetworks |
- cpe:2.3:o:arubanetworks:5400r_firmware:*:*:*:*:*:*:*:* Versions 16.08.0 to before 16.08.0009; 16.09.0 to before 16.09.0007; 16.10.0 to before 16.10.0003 Vulnerable ·Arubanetworks
- cpe:2.3:h:arubanetworks:5400r:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Arubanetworks
- cpe:2.3:o:arubanetworks:3810_firmware:*:*:*:*:*:*:*:* Versions 16.08.0 to before 16.08.0009; 16.09.0 to before 16.09.0007; 16.10.0 to before 16.10.0003 Vulnerable ·Arubanetworks
- cpe:2.3:h:arubanetworks:3810:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Arubanetworks
- cpe:2.3:o:arubanetworks:2920_firmware:*:*:*:*:*:*:*:* Versions 16.08.0 to before 16.08.0009; 16.09.0 to before 16.09.0007; 16.10.0 to before 16.10.0003 Vulnerable ·Arubanetworks
- cpe:2.3:h:arubanetworks:2920:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Arubanetworks
- cpe:2.3:o:arubanetworks:2930_firmware:*:*:*:*:*:*:*:* Versions 16.08.0 to before 16.08.0009; 16.09.0 to before 16.09.0007; 16.10.0 to before 16.10.0003 Vulnerable ·Arubanetworks
- cpe:2.3:h:arubanetworks:2930:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Arubanetworks
- cpe:2.3:o:arubanetworks:2530_with_gigt_port_firmware:*:*:*:*:*:*:*:* Versions 16.08.0 to before 16.08.0009; 16.09.0 to before 16.09.0007; 16.10.0 to before 16.10.0003 Vulnerable ·Arubanetworks
- cpe:2.3:h:arubanetworks:2530_with_gigt_port:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Arubanetworks
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:arubanetworks:2530_10\/100_port_firmware:*:*:*:*:*:*:*:* | 16.08.0 to before 16.08.0009; 16.09.0 to before 16.09.0007; 16.10.0 to before 16.10.0003 | Vulnerable | Arubanetworks |
| cpe:2.3:h:arubanetworks:2530_10\/100_port:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Arubanetworks |
| cpe:2.3:o:arubanetworks:2540_firmware:*:*:*:*:*:*:*:* | 16.08.0 to before 16.08.0009; 16.09.0 to before 16.09.0007; 16.10.0 to before 16.10.0003 | Vulnerable | Arubanetworks |
| cpe:2.3:h:arubanetworks:2540:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Arubanetworks |
- cpe:2.3:o:arubanetworks:2530_10\/100_port_firmware:*:*:*:*:*:*:*:* Versions 16.08.0 to before 16.08.0009; 16.09.0 to before 16.09.0007; 16.10.0 to before 16.10.0003 Vulnerable ·Arubanetworks
- cpe:2.3:h:arubanetworks:2530_10\/100_port:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Arubanetworks
- cpe:2.3:o:arubanetworks:2540_firmware:*:*:*:*:*:*:*:* Versions 16.08.0 to before 16.08.0009; 16.09.0 to before 16.09.0007; 16.10.0 to before 16.10.0003 Vulnerable ·Arubanetworks
- cpe:2.3:h:arubanetworks:2540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Arubanetworks
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5322
- 2026-10-03 Alias added: GHSA-qwq2-xgfg-rqx9
References
Sources
- CVE-2019-5322 · CVE Program
- CVE-2019-5322 · NVD
- FIRST EPSS
- GHSA-qwq2-xgfg-rqx9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences