Security News > 2022 > October > Aruba fixes critical RCE and auth bypass flaws in EdgeConnect

Aruba has released security updates for the EdgeConnect Enterprise Orchestrator, addressing multiple critical severity vulnerabilities that enable remote attackers to compromise the host.

Aruba EdgeConnect Orchestrator is a widely used WAN management solution, offering enterprise users optimization, administration, automation, and real-time visibility and monitoring features.

CVE-2022-37913 and CVE-2022-37914: Authentication bypass flaw in the web-based management interface of EdgeConnect Orchestrator, allowing an unauthenticated, remote attacker to bypass authentication.

CVE-2022-37915: Flaw in the web-based management interface of EdgeConnect Orchestrator, allowing arbitrary command execution on the underlying host and leading to complete system compromise.

Aruba has noted that, as of today, it has not detected active exploitation of the mentioned flaws and has seen no discussions or proof of concept exploits that target the vulnerabilities.

Considering the criticality of the flaws and broad deployment of EdgeConnect in valuable environments, it's safe to suggest that attackers will attempt to create exploits for the vulnerabilities.

News URL

https://www.bleepingcomputer.com/news/security/aruba-fixes-critical-rce-and-auth-bypass-flaws-in-edgeconnect/