QID 43828

Aruba Networks provides data networking solutions for enterprises and businesses worldwide.

CVE-2020-26146: The Aruba Access Point does not check whether all fragments of a frame have consecutive PN, that is, whether the fragments indeed belong to the same frame or not.
CVE-2020-24588: Due to some misconfiguration an attacker can alter A-MSDU bit from the QoS Control subfield of the 802.11 MAC header and steal sensitive data.

Affected Versions:
-- ArubaOS 6.4.x prior to 6.4.4.25
-- ArubaOS 6.5.x: prior to 6.5.4.19
-- ArubaOS 8.3.x: prior to 8.3.0.15
-- ArubaOS 8.5.x: prior to 8.5.0.12
-- ArubaOS 8.6.x: prior to 8.6.0.8
-- ArubaOS 8.7.x: prior to 8.7.1.2

QID Detection Logic (Unauthenticated):
This QID gets the vulnerable ArubaOS version via SNMP.

Successful exploitation of these vulnerabilities may allow an attacker to steal or inject victim data using MitM attack.