Details of VAR-202110-1631

ID

VAR-202110-1631

CVE

CVE-2021-37734

TITLE

Aruba Instant path traversal vulnerability

Trust: 1.2

sources: CNVD: CNVD-2021-89449 // CNNVD: CNNVD-202110-411

DESCRIPTION

A remote unauthorized read access to files vulnerability was discovered in Aruba Instant version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.19 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3 and below; Aruba Instant 8.8.x.x: 8.8.0.0 and below. Aruba has released patches for Aruba Instant (IAP) that address this security vulnerability. Provides the only Wi-Fi solution that is easy to set up. Aruba Instant has a path traversal vulnerability, which stems from an input validation error when processing a directory traversal sequence in the instant command line interface. An attacker can use the vulnerability to view the contents of any file on the system

Trust: 1.53

sources: NVD: CVE-2021-37734 // CNVD: CNVD-2021-89449 // VULMON: CVE-2021-37734

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2021-89449

AFFECTED PRODUCTS

vendor:	arubanetworks	model:	aruba instant	scope:	lt	version:	6.4.4.8-4.2.4.19	Trust: 1.0
vendor:	arubanetworks	model:	aruba instant	scope:	gte	version:	8.6.0.0	Trust: 1.0
vendor:	arubanetworks	model:	aruba instant	scope:	gte	version:	6.4.0.2-4.1.0.0	Trust: 1.0
vendor:	siemens	model:	scalance w1750d	scope:	gte	version:	8.7.1.3	Trust: 1.0
vendor:	arubanetworks	model:	aruba instant	scope:	lt	version:	8.6.0.12	Trust: 1.0
vendor:	arubanetworks	model:	aruba instant	scope:	gte	version:	8.5.0.0	Trust: 1.0
vendor:	arubanetworks	model:	aruba instant	scope:	lt	version:	8.5.0.13	Trust: 1.0
vendor:	arubanetworks	model:	aruba instant	scope:	gte	version:	6.5.4.0	Trust: 1.0
vendor:	arubanetworks	model:	aruba instant	scope:	lt	version:	6.5.4.20	Trust: 1.0
vendor:	arubanetworks	model:	aruba instant	scope:	gte	version:	8.7.0.0	Trust: 1.0
vendor:	arubanetworks	model:	aruba instant	scope:	lt	version:	8.7.1.4	Trust: 1.0
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.1	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.2	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.3	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.4	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.5	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.6	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.7	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.8	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.9	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.10	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.11	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.12	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.13	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.14	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.15	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.16	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.17	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.18	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.5.0.0	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.5.0.1	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.5.0.2	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.5.0.3	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.5.0.4	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.5.0.5	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.5.0.6	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.5.0.7	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.5.0.8	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.5.0.9	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.5.0.10	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.5.0.11	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.6.0.0	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.6.0.1	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.6.0.2	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.6.0.3	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.6.0.4	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.6.0.5	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.6.0.6	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.7.0.0	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.7.1.0	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.4.4.8-4.2.4.18	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	6.5.4.19	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.5.0.12	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.6.0.7	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.6.0.8	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.6.0.9	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.6.0.10	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.6.0.11	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.7.1.1	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.7.1.2	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.7.1.3	Trust: 0.6
vendor:	aruba	model:	instant	scope:	eq	version:	8.8.0.0	Trust: 0.6
vendor:	aruba	model:	networks aruba instant	scope:	eq	version:	8.7.x.x	Trust: 0.6
vendor:	aruba	model:	networks aruba instant	scope:	eq	version:	6.4.x.x	Trust: 0.6
vendor:	aruba	model:	networks aruba instant	scope:	eq	version:	6.5.x.x	Trust: 0.6
vendor:	aruba	model:	networks aruba instant	scope:	eq	version:	8.6.x.x	Trust: 0.6

sources: CNVD: CNVD-2021-89449 // NVD: CVE-2021-37734

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-37734
value:	MEDIUM
Trust: 1.0
CNVD:	CNVD-2021-89449
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202110-411
value:	MEDIUM
Trust: 0.6
VULMON:	CVE-2021-37734
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2021-37734
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
CNVD:	CNVD-2021-89449
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2021-37734
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.1
Trust: 1.0

sources: CNVD: CNVD-2021-89449 // VULMON: CVE-2021-37734 // CNNVD: CNNVD-202110-411 // NVD: CVE-2021-37734

PROBLEMTYPE DATA

problemtype:

CWE-22

Trust: 1.0

sources: NVD: CVE-2021-37734

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202110-411

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-202110-411

PATCH

title:	Patch for Aruba Instant path traversal vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/300086	Trust: 0.6
title:	Aruba Instant Repair measures for path traversal vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=165082	Trust: 0.6
title:	Siemens Security Advisories: Siemens Security Advisory	url:	https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=3a4aac694122a77f4f689c8a03f6ae75	Trust: 0.1

sources: CNVD: CNVD-2021-89449 // VULMON: CVE-2021-37734 // CNNVD: CNNVD-202110-411

EXTERNAL IDS

db:	NVD	id:	CVE-2021-37734	Trust: 2.3
db:	SIEMENS	id:	SSA-917476	Trust: 1.7
db:	CS-HELP	id:	SB2021100720	Trust: 1.2
db:	ICS CERT	id:	ICSA-21-315-06	Trust: 0.7
db:	CNVD	id:	CNVD-2021-89449	Trust: 0.6
db:	CS-HELP	id:	SB2021111005	Trust: 0.6
db:	AUSCERT	id:	ESB-2021.3874	Trust: 0.6
db:	CNNVD	id:	CNNVD-202110-411	Trust: 0.6
db:	VULMON	id:	CVE-2021-37734	Trust: 0.1

sources: CNVD: CNVD-2021-89449 // VULMON: CVE-2021-37734 // CNNVD: CNNVD-202110-411 // NVD: CVE-2021-37734

REFERENCES

url:	https://www.arubanetworks.com/assets/alert/aruba-psa-2021-017.txt	Trust: 1.7
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-917476.pdf	Trust: 1.7
url:	https://www.cybersecurity-help.cz/vdb/sb2021100720	Trust: 1.2
url:	https://www.cybersecurity-help.cz/vdb/sb2021111005	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2021.3874	Trust: 0.6
url:	https://us-cert.cisa.gov/ics/advisories/icsa-21-315-06	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/22.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-06	Trust: 0.1

sources: CNVD: CNVD-2021-89449 // VULMON: CVE-2021-37734 // CNNVD: CNNVD-202110-411 // NVD: CVE-2021-37734

CREDITS

Siemens reported these vulnerabilities to CISA.

Trust: 0.6

sources: CNNVD: CNNVD-202110-411

SOURCES

db:	CNVD	id:	CNVD-2021-89449
db:	VULMON	id:	CVE-2021-37734
db:	CNNVD	id:	CNNVD-202110-411
db:	NVD	id:	CVE-2021-37734

LAST UPDATE DATE

2024-08-14T12:31:00.848000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2021-89449	date:	2021-11-20T00:00:00
db:	VULMON	id:	CVE-2021-37734	date:	2022-07-12T00:00:00
db:	CNNVD	id:	CNNVD-202110-411	date:	2022-07-14T00:00:00
db:	NVD	id:	CVE-2021-37734	date:	2022-07-12T17:42:04.277

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2021-89449	date:	2021-11-20T00:00:00
db:	VULMON	id:	CVE-2021-37734	date:	2021-10-12T00:00:00
db:	CNNVD	id:	CNNVD-202110-411	date:	2021-10-07T00:00:00
db:	NVD	id:	CVE-2021-37734	date:	2021-10-12T16:15:07.467