A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack. Successful exploitation could enable the attacker to execute arbitrary script code in the victim's browser within the context of the affected interface.
2025-04-08T17:15:36.700
2025-11-12T20:14:34.770
Analyzed
CVSSv3.1: 5.4 (MEDIUM)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Operating System | arubanetworks | arubaos | < 8.10.0.16 | Yes |
| Operating System | arubanetworks | arubaos | < 8.12.0.4 | Yes |
| Operating System | arubanetworks | arubaos | < 10.4.1.7 | Yes |
| Operating System | arubanetworks | arubaos | < 10.7.1.1 | Yes |