Cyber Resilience

CVE-2022-37905

Medium

Published: 12 December 2022

Published
12 December 2022
Modified
02 May 2025
KEV Added
—
Patch
—
CVSS Score v3.1 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0171 82.7th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-37905 is a medium-severity Improper Neutralization of Formula Elements in a CSV File (CWE-1236) vulnerability in Arubanetworks Arubaos. Its CVSS base score is 6.6 (Medium).

Operationally, ranked in the top 17.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system.

CWE(s)
NVD-CWE-noinfoCWE-1236

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

arubanetworks
sd-wan
8.7.0.0-2.3.0.0 — 8.7.0.0-2.3.0.6
arubanetworks
arubaos
10.3.0.0 · 6.5.4.0 — 6.5.4.22 · 8.4.0.0 — 8.6.0.17 · 8.7.0.0 — 8.7.1.9

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References