CVE-2021-37718
highpriority · track · 30EPSS 0.031 · 87 %ileDEEUUSEPSS · scored 2026-10-26
A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.6; Prior to 8.7.1.4, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSCALANCE W1750Dsiemens_psirt
Update to V8.7.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109802805/ - FixedSCALANCE W1750Dcisa_csaf_ot
Update to V8.7.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109802805/ - WorkaroundSCALANCE W1750Dsiemens_psirt
Block access to the ArubaOS Command Line Interface from all untrusted users
- WorkaroundSCALANCE W1750Dcisa_csaf_ot
Block access to the ArubaOS Command Line Interface from all untrusted users
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–9
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (13)
Products and version ranges known to be affected.
- n/a Aruba SD-WAN Software and Gateways; Aruba Operating System Software≤ Prior to 8.7.1.4, 8.6.0.7, 8.5.0.12, 8.3.0.16enisa_euvdEU
- n/a Aruba SD-WAN Software and Gateways; Aruba Operating System Software≤ Prior to 8.6.0.4-2.2.0.6enisa_euvdEU
- siemens scalance w1750d firmwareall versionsnvdUScpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:*
advisories (2)
Vendor and ecosystem advisories describing this.
- SSA-280624SSA-280624: Multiple Vulnerabilities in SCALANCE W1750D2021-10-12csaf · siemens_psirtDE
The Scalance W1750D device contains multiple vulnerabilities that could allow an attacker to inject commands or exploit multiple buffer overflow vulnerabilities that could lead to denial of service or unauthenticated remote code execution. Siemens has released updates for the SCALANCE W1750D and recommends to update to the latest version. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
- ICSA-21-287-07Siemens SCALANCE2021-10-12icsa · cisa_csaf_otUS
The Scalance W1750D device contains multiple vulnerabilities that could allow an attacker to inject commands or exploit multiple buffer overflow vulnerabilities that could lead to denial of service or unauthenticated remote code execution. Siemens has released updates for the SCALANCE W1750D and recommends to update to the latest version. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdfcnnvd
- https://github.com/tuxera/ntfs-3g。Patchcnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-287-07cnnvd
- https://vigilance.fr/vulnerability/ArubaOS-multiple-vulnerabilities-36283cnnvd
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-016.txtcnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.3458cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021090213cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-280624.pdfenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan