72 Flaws, Eight Rated 10 Out of 10: The Spec Sheet for HPE’s Aruba Wireless Patch, and Which Version Your Access Points Need
HPE has fixed 72 vulnerabilities in the AOS-8 and AOS-10 operating systems behind Aruba wireless controllers, gateways and access points, including eight maximum-severity flaws that need no login. Here is the spec sheet: what is affected, the fixed versions, and what to do if your gear runs an older release.
Wireless gear tends to be installed once and then forgotten on the ceiling. HPE’s latest update for its Aruba wireless operating systems is a reason to look up. The company has patched 72 vulnerabilities, and eight of them carry the maximum severity score.
This spec sheet is based on BleepingComputer’s report on the patches and HPE’s security bulletin HPESBNW05162, published October 22.
The spec sheet
- Products: Mobility Conductors, Mobility Controllers, Mobility Gateways managed by HPE Networking Central, AOS-10 access points and AOS-8 Instant access points.
- Flaw count: 72 in total. The eight most severe allow authentication bypass or code execution by a remote attacker with no privileges, through low-complexity attacks that need no user interaction.
- Affected versions: AOS-10.8 up to 10.8.1.1, AOS-10.7 up to 10.7.2.6, AOS-10.4 up to 10.4.1.13, AOS-8.13 up to 8.13.3.0, and AOS-8.10 up to 8.10.0.23.
- Fixed versions: 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 and 8.10.0.24, or later on the same branch.
- Older releases: Software past end of maintenance is presumed affected and is not covered by the bulletin. HPE says it has not assessed releases past end of support, so treat those as exposed.
- Exploitation: HPE says it knows of no public exploit code or attacks as of the bulletin date. Most of the flaws were found by its own researchers.
- Workaround: Restrict the command-line and web management interfaces to a dedicated layer 2 segment or VLAN, or control them with firewall rules, and keep accounting logs of administrator activity.
Why the number matters
A count of 72 in one bulletin usually means several flaws can be chained, which is why HPE urges customers to patch because of the “complexity, breadth, and impact” of the issues rather than one headline bug. Wireless controllers and gateways often sit in the same network segment as staff laptops, so a compromise there can give an attacker a strong position inside the office.
Quick checklist
- List every Aruba controller, gateway and access point you own, and note whether it runs AOS-8 or AOS-10 and which release.
- Compare each release to the fixed versions above. If you are on a branch the bulletin does not list, plan a move to a supported branch rather than waiting for a patch.
- Confirm that management interfaces are only reachable from an admin VLAN or a few trusted addresses, never from guest Wi-Fi or the internet.
- Schedule the upgrade after hours, since access points may reboot, and verify the new version afterward.
- If your access points are managed in the cloud, confirm the console shows the upgrade completed on every site.
What this means for your company
Whatever brand of wireless equipment you use, it runs software that needs updates like any server. Keep an inventory of your network gear with model and firmware version, check vendor advisories monthly, and keep the admin pages for wireless, switches and firewalls on a separate management network. Devices that are past end of support should be on a replacement plan, because they will stop receiving fixes like these.
Need help inventorying your wireless gear and getting it onto supported, patched firmware? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
