Improper authentication in Aruba AirWave Glass Software
Priority LOW 36CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287, CWE-918 and the CVSS impact.
Summary
In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if successfully exploited can result in disclosure of sensitive information. This can be used to perform an authentication bypass and ultimately gain administrative access on the web administrative interface.
Why it matters now
EPSS 0.01481 74th percentileScored 2026-11-07
Fix Fixed Aruba AirWave Glass Software: 1.3.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Aruba AirWave Glass Software | before 1.3.3 | 1.3.3 | Patch available | CNA |
- Aruba AirWave Glass Software Vendor— Affected before 1.3.3 Fixed in 1.3.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:arubanetworks:airwave_glass:*:*:*:*:*:*:*:* | before 1.3.3 | Vulnerable | Arubanetworks |
- cpe:2.3:a:arubanetworks:airwave_glass:*:*:*:*:*:*:*:* Versions before 1.3.3 Vulnerable ·Arubanetworks
Remediation
- Fix · CNA Aruba AirWave Glass Software Fixed in 1.3.3
Timeline
- 2026-10-02 Threatist record created from CVE-2020-24641
- 2026-10-03 Alias added: GHSA-5x44-6vjc-wrhm
References
More Arubanetworks Airwave Glass vulnerabilities
- TI-2020-15111 Deserialization of untrusted data in Aruba AirWave Glass Software CVSS 3.1CRITICAL 9.8
- TI-2020-15112 There is a vulnerability caused by insufficient input validation that allows for… CVSS 3.1CRITICAL 9.8
- TI-2020-05740 Missing authentication in Aruba Airwave Software CVSS 3.1CRITICAL 9.8
- TI-2020-05739 A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba… CVSS 3.1CRITICAL 9.8
- TI-2020-05736 A remote unauthorized access vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. CVSS 3.1CRITICAL 9.8
- TI-2020-05737 A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. CVSS 3.1HIGH 8.8
Sources
- CVE-2020-24641 · CVE Program
- CVE-2020-24641 · NVD
- FIRST EPSS
- GHSA-5x44-6vjc-wrhm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences