CVE-2022-37893
highpriority · track · 31EPSS 0.007 · 54 %ileDEEUUSEPSS · scored 2026-10-27
An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InstantOS that address this security vulnerability.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSCALANCE W1750D (JP) (6GK5750-2HX01-1AD0)siemens_psirt
Update to V8.7.1.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816886/ - FixedSCALANCE W1750D (ROW) (6GK5750-2HX01-1AA0)siemens_psirt
Update to V8.7.1.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816886/ - FixedSCALANCE W1750D (USA) (6GK5750-2HX01-1AB0)siemens_psirt
Update to V8.7.1.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816886/ - FixedSCALANCE W1750D (JP) (6GK5750-2HX01-1AD0)cisa_csaf_ot
Update to V8.7.1.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816886/ - FixedSCALANCE W1750D (ROW) (6GK5750-2HX01-1AA0)cisa_csaf_ot
Update to V8.7.1.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816886/ - FixedSCALANCE W1750D (USA) (6GK5750-2HX01-1AB0)cisa_csaf_ot
Update to V8.7.1.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816886/ - MitigationSCALANCE W1750D (JP) (6GK5750-2HX01-1AD0)siemens_psirt
CVE-2022-37893: Restrict the command line interface to a dedicated layer 2 segment/VLAN and/or control the interface by firewall policies at layer 3 and above
- MitigationSCALANCE W1750D (ROW) (6GK5750-2HX01-1AA0)siemens_psirt
CVE-2022-37893: Restrict the command line interface to a dedicated layer 2 segment/VLAN and/or control the interface by firewall policies at layer 3 and above
- MitigationSCALANCE W1750D (USA) (6GK5750-2HX01-1AB0)siemens_psirt
CVE-2022-37893: Restrict the command line interface to a dedicated layer 2 segment/VLAN and/or control the interface by firewall policies at layer 3 and above
- MitigationSCALANCE W1750D (JP) (6GK5750-2HX01-1AD0)cisa_csaf_ot
CVE-2022-37893: Restrict the command line interface to a dedicated layer 2 segment/VLAN and/or control the interface by firewall policies at layer 3 and above
- MitigationSCALANCE W1750D (ROW) (6GK5750-2HX01-1AA0)cisa_csaf_ot
CVE-2022-37893: Restrict the command line interface to a dedicated layer 2 segment/VLAN and/or control the interface by firewall policies at layer 3 and above
- MitigationSCALANCE W1750D (USA) (6GK5750-2HX01-1AB0)cisa_csaf_ot
CVE-2022-37893: Restrict the command line interface to a dedicated layer 2 segment/VLAN and/or control the interface by firewall policies at layer 3 and above
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (22)
Products and version ranges known to be affected.
- n/a Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series;≤ Aruba InstantOS 8.6.x: 8.6.0.18 and belowenisa_euvdEU
- n/a Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series;≤ Aruba InstantOS 8.10.x: 8.10.0.1 and belowenisa_euvdEU
- n/a Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series;≤ Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and belowenisa_euvdEU
- n/a Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series;≤ ArubaOS 10.3.x: 10.3.1.0 and belowenisa_euvdEU
- n/a Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series;≤ Aruba InstantOS 6.5.x: 6.5.4.23 and belowenisa_euvdEU
- n/a Aruba Access Points: 100 Series; 103 Series; 110 Series; 120 Series; 130 Series; 200 Series; 207 Series; 210 Series; 220 Series; 260 Series; 300 Series; 303 Series; 310 Series; 318 Series Hardened Access Points; 320 Series; 330 Series; 340 Series; 370 Series; 500 Series; 510 Series; 530 Series; 550 Series; 630 Series; 650 Series;≤ Aruba InstantOS 8.7.x: 8.7.1.9 and belowenisa_euvdEU
- siemens scalance w1750d firmwareall versionsnvdUScpe:2.3:o:siemens:scalance_w1750d_firmware:*:*:*:*:*:*:*:*
advisories (2)
Vendor and ecosystem advisories describing this.
- SSA-506569SSA-506569: Multiple Vulnerabilities in SCALANCE W1750D2022-11-08csaf · siemens_psirtDE
The SCALANCE W1750D device contains multiple vulnerabilities that could allow an attacker to inject commands or exploit buffer overflow vulnerabilities which could lead to denial of service, unauthenticated remote code execution or stored XSS. Siemens has released updates for the affected products and recommends to update to the latest versions.
- ICSA-22-314-10Siemens SCALANCE W1750D2022-11-08icsa · cisa_csaf_otUS
The SCALANCE W1750D device contains multiple vulnerabilities that could allow an attacker to inject commands or exploit buffer overflow vulnerabilities which could lead to denial of service, unauthenticated remote code execution or stored XSS. Siemens has released updates for the affected products and recommends to update to the latest versions.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdfcnnvd
- https://cxsecurity.com/cveshow/CVE-2022-37893/cnnvd
- https://vigilance.fr/vulnerability/ArubaOS-multiple-vulnerabilities-39383cnnvd
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txtcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdfenisa_euvd
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txtenisa_euvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdfThird Party Advisorynvd
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-014.txtVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan