A local bypass security restrictions vulnerability was discovered in Aruba CX 6200F…
Priority LOW 27Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A local bypass security restrictions vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): Aruba AOS-CX firmware: 10.04.xxxx - versions prior to 10.04.3070, 10.05.xxxx - versions prior to 10.05.0070, 10.06.xxxx - versions prior to 10.06.0110, 10.07.xxxx - versions prior to 10.07.0001. Aruba has released upgrades for Aruba AOS-CX devices that address this security vulnerability.
Why it matters now
EPSS 0.00249 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series | Aruba AOS-CX firmware: 10.04.xxxx - versions prior to 10.04.3070, 10.05.xxxx - versions prior to 10.05.0070, 10.06.xxxx - versions prior to 10.06.0110, 10.07.xxxx - versions prior to 10.07.0001 | — | No fix listed | CNA |
- Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series Vendor— Affected Aruba AOS-CX firmware: 10.04.xxxx - versions prior to 10.04.3070, 10.05.xxxx - versions prior to 10.05.0070, 10.06.xxxx - versions prior to 10.06.0110, 10.07.xxxx - versions prior to 10.07.0001 Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:arubanetworks:aos-cx_firmware:*:*:*:*:*:*:*:* | 10.04.000 to before 10.04.3070; 10.05.0000 to before 10.05.0070; 10.06.0000 – 10.06.0110; 10.07.0000 – 10.07.0001 | Vulnerable | Arubanetworks |
| cpe:2.3:h:arubanetworks:cx_6200f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Arubanetworks |
| cpe:2.3:h:arubanetworks:cx_6300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Arubanetworks |
| cpe:2.3:h:arubanetworks:cx_6400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Arubanetworks |
| cpe:2.3:h:arubanetworks:cx_8320:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Arubanetworks |
| cpe:2.3:h:arubanetworks:cx_8325:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Arubanetworks |
| cpe:2.3:h:arubanetworks:cx_8360:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Arubanetworks |
| cpe:2.3:h:arubanetworks:cx_8400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Arubanetworks |
- cpe:2.3:o:arubanetworks:aos-cx_firmware:*:*:*:*:*:*:*:* Versions 10.04.000 to before 10.04.3070; 10.05.0000 to before 10.05.0070; 10.06.0000 – 10.06.0110; 10.07.0000 – 10.07.0001 Vulnerable ·Arubanetworks
- cpe:2.3:h:arubanetworks:cx_6200f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Arubanetworks
- cpe:2.3:h:arubanetworks:cx_6300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Arubanetworks
- cpe:2.3:h:arubanetworks:cx_6400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Arubanetworks
- cpe:2.3:h:arubanetworks:cx_8320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Arubanetworks
- cpe:2.3:h:arubanetworks:cx_8325:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Arubanetworks
- cpe:2.3:h:arubanetworks:cx_8360:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Arubanetworks
- cpe:2.3:h:arubanetworks:cx_8400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Arubanetworks
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29149
- 2026-10-03 Alias added: GHSA-wfq6-vc3m-f5f7
References
More Arubanetworks Aos-cx Firmware vulnerabilities
- TI-2021-10014 OS command injection in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba… CVSS 3.1HIGH 7.2
- TI-2021-10019 Cross-site scripting in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba… CVSS 3.1MEDIUM 6.1
Sources
- CVE-2021-29149 · CVE Program
- CVE-2021-29149 · NVD
- FIRST EPSS
- GHSA-wfq6-vc3m-f5f7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences