Read the docs
TI-2023-03473 Aliases CVE-2023-3718GHSA-jmx3-98vw-w6hq

Authenticated Command Injection Vulnerability in AOS-CX Command Line Interface

Priority MEDIUM 43CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

An authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands on the underlying operating system as a privileged user on the affected switch. This allows an attacker to fully compromise the underlying operating system on the device running AOS-CX.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01637 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hewlett Packard Enterprise (HPE)Aruba CX SwitchesAOS-CX 10.11.xxxx: 10.11.1010 and below; AOS-CX 10.10.xxxx: 10.10.1050 and below—No fix listedCNA
  • Aruba CX Switches VendorHewlett Packard Enterprise (HPE) Affected AOS-CX 10.11.xxxx: 10.11.1010 and below; AOS-CX 10.10.xxxx: 10.10.1050 and below Fixed in — No fix listed CNA

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*10.10.0000 – 10.10.1050; 10.11.0000 – 10.11.1010VulnerableHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_10000-48y6:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_4100i:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_6000_12g:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_6000_24g:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_6000_48g:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_6100:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_6200f:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_6200f_48g:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_6200m:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:hpe:aruba_cx_6200m_24g:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_6300m_24p:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_6300m_48g:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_6405:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_6410:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_8320-32:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_8320-48p:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_8325-32c:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_8325-48y8c:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_8360-12c:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_8360-16y2c:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_8360-24xf2c:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_8360-32y4c:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_8360-48xt4c:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_8360-48y6c:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_8400:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:aruba_cx_9300_32d:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-3718
  2. 2026-10-03 Alias added: GHSA-jmx3-98vw-w6hq

References

Advisory 1

  • TI-2002-02356 The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side)… CVSS 3.1HIGH 7.5
  • TI-2026-51814 Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX CVSS 3.1CRITICAL 9.8
  • TI-2026-19179 Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset CVSS 3.1CRITICAL 9.8
  • TI-2026-51843 Credential Manager Vulnerability Allows Unauthorized Administrative Access CVSS 3.1CRITICAL 9.8
  • TI-2026-19182 Authenticated Command Injection found in admin AOS-CX CLI command CVSS 3.1HIGH 8.8
  • TI-2021-17871 Command injection in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400… CVSS 3.1HIGH 8.8
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences