CVE-2018-7080

mediumpriority · track · 30EPSS 0.006 · 51 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.64% (51st) EPSS

CVSS 5.4 · medium

Is it mine?

11 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-27

A vulnerability exists in the firmware of embedded BLE radios that are part of some Aruba Access points. An attacker who is able to exploit the vulnerability could install new, potentially malicious firmware into the AP's BLE radio and could then gain access to the AP's console port. This vulnerability is applicable only if the BLE radio has been enabled in affected access points. The BLE radio is disabled by default. Note - Aruba products are NOT affected by a similar vulnerability being tracked as CVE-2018-16986.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.4–7.5

v2.05.4mediumAV:A/AC:M/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 5.5 · impact 6.4

v3.07.5highCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.6 · impact 5.9

v3.06.9mediumCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.1highAV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:Hsecondary · FSTEC (BDU) RU

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-415US

affected products (11)

Products and version ranges known to be affected.

Hewlett Packard Enterprise Aruba Access Points≤ AP-3xx and IAP-3xx series access points, AP-203R, AP-203RP, ArubaOS 6.4.4.x prior to 6.4.4.20, ArubaOS 6.5.3.x prior to 6.5.3.9, ArubaOS 6.5.4.x prior to 6.5.4.9, ArubaOS 8.x prior to 8.2.2.2, ArubaOS 8.3.x prior to 8.3.0.4enisa_euvdEU
Texas Instruments Inc. BLE-STACK≤ 2.2.2fstec_bduRU
arubanetworks 203r firmwareall versionsnvdUScpe:2.3:o:arubanetworks:203r_firmware:*:*:*:*:*:*:*:*
arubanetworks 203rp firmwareall versionsnvdUScpe:2.3:o:arubanetworks:203rp_firmware:*:*:*:*:*:*:*:*
arubanetworks ap-300 series access points firmwareall versionsnvdUScpe:2.3:o:arubanetworks:ap-300_series_access_points_firmware:*:*:*:*:*:*:*:*
arubanetworks ap-300 series instant access points firmwareall versionsnvdUScpe:2.3:o:arubanetworks:ap-300_series_instant_access_points_firmware:*:*:*:*:*:*:*:*
arubanetworks arubaos6.4.4.0 → 6.4.4.20nvdUScpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
arubanetworks arubaos6.5.3.0 → 6.5.3.9nvdUScpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
arubanetworks arubaos6.5.4.0 → 6.5.4.9nvdUScpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
arubanetworks arubaos8.0.0.0 → 8.2.2.2nvdUScpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
arubanetworks arubaos8.3.0.0 → 8.3.0.4nvdUScpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2018-12-07modified 2026-06-17

references (6)

External citations — patches, advisories, analysis.

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-006.txt cnnvd
https://www.securityfocus.com/bid/105814 cnnvd
http://www.securityfocus.com/bid/105814 enisa_euvd
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-006.txt enisa_euvd
http://www.securityfocus.com/bid/105814Third Party AdvisoryVDB Entrynvd
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-006.txtMitigationVendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan