CVE-2023-37426
Summary
| CVE | CVE-2023-37426 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-08-22 19:16:00 UTC |
| Updated | 2023-08-30 14:21:00 UTC |
| Description | EdgeConnect SD-WAN Orchestrator instances prior to the versions resolved in this advisory were found to have shared static SSH host keys for all installations. This vulnerability could allow an attacker to spoof the SSH host signature and thereby masquerade as a legitimate Orchestrator host. |
Risk And Classification
Problem Types: CWE-798
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Arubanetworks | Edgeconnect Sd-wan Orchestrator | 9.3.0 | All | All | All |
| Application | Arubanetworks | Edgeconnect Sd-wan Orchestrator | All | All | All | All |
| Application | Arubanetworks | Edgeconnect Sd-wan Orchestrator | All | All | All | All |
| Application | Arubanetworks | Edgeconnect Sd-wan Orchestrator | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Access Denied | MISC | www.arubanetworks.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.