"Palo Alto Networks, Aruba Patch Severe Vulnerabilities"

Palo Alto Networks and Aruba Networks have recently released patches for severe vulnerabilities affecting their products.  An advisory published by Palo Alto Networks on October 12 informs customers about a high-severity authentication bypass vulnerability affecting the web interface of its PAN-OS 8.1 software.  The vulnerability is tracked as CVE-2022-0030.  According to Palo Alto Networks, a network-based attacker with specific knowledge of the targeted firewall or Panorama appliance can impersonate an existing PAN-OS admin and perform privileged actions.  PAN-OS 8.1.24 and later versions patch the vulnerability, but the vendor noted that PAN-OS 8.1 has reached end of life (EOL) and is supported only on certain firewalls and appliances until they reach EOL status as well.  Authentication bypass flaws have also been identified in Aruba’s EdgeConnect Enterprise Orchestrator product.  The company noted that the product is impacted by two critical authentication bypass issues that can lead to a complete compromise of the orchestrator host.  The flaws are tracked as CVE-2022-37913 and CVE-2022-37914, and they can be exploited remotely by an unauthenticated attacker to obtain admin privileges on the targeted system.  An advisory describing the vulnerabilities was published on October 11.  The advisory also informs Aruba customers about a critical unauthenticated, remote code execution vulnerability (CVE-2022-37915) affecting the same orchestrator product.  The company noted that a vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated, remote attacker to run arbitrary commands on the underlying host.  The company stated that successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.  Aruba has released updates for supported versions of the product to patch these security holes.  Both Palo Alto Networks and Aruba said they are unaware of any attacks exploiting these vulnerabilities.

SecurityWeek reports: "Palo Alto Networks, Aruba Patch Severe Vulnerabilities"