Critical TLStorm 2.0 Bugs Affect Widely-Used Aruba and Avaya Network Switches

Cybersecurity researchers have detailed as many as five severe
security flaws in the implementation of TLS protocol in several
models of Aruba and Avaya network switches that could be abused to
gain remote access to enterprise networks and steal valuable
information.

The findings follow the March disclosure of TLStorm^[1], a set of three critical
flaws in APC Smart-UPS devices that could permit an attacker to
take over control and, worse, physically damage the appliances.

IoT security firm Armis, which uncovered the shortcomings, noted
that the design flaws can be traced back to a common source: a
misuse of NanoSSL^[2], a standards-based SSL
developer suite from Mocana, a DigiCert subsidiary.

The new set of flaws, dubbed TLStorm 2.0^[3], renders Aruba and Avaya
network switches vulnerable to remote code execution
vulnerabilities, enabling an adversary to commandeer the devices,
move laterally across the network, and exfiltrate sensitive
data.

Affected devices include Avaya ERS3500 Series, ERS3600 Series,
ERS4900 Series, and ERS5900 Series as well as Aruba 5400R Series,
3810 Series, 2920 Series, 2930F Series, 2930M Series, 2530 Series,
and 2540 Series.

Armis chalked up the flaws to an “edge case,” a failure to
adhere to guidelines pertaining to the NanoSSL library that could
result in remote code execution. The list of remote code execution
bugs is as follows –

• CVE-2022-23676 (CVSS score: 9.1) – Two memory corruption
  vulnerabilities in the RADIUS^[4]
  client implementation of Aruba switches
• CVE-2022-23677 (CVSS score: 9.0) – NanoSSL misuse on
  multiple interfaces in Aruba switches
• CVE-2022-29860 (CVSS score: 9.8) – TLS reassembly heap
  overflow vulnerability in Avaya switches
• CVE-2022-29861 (CVSS score: 9.8) – HTTP header parsing
  stack overflow vulnerability in Avaya switches
• HTTP POST request handling heap overflow vulnerability in a
  discontinued Avaya product line (no CVE)

“These research findings are significant as they highlight that
the network infrastructure itself is at risk and exploitable by
attackers, meaning that network segmentation alone is no longer
sufficient as a security measure,” Barak Hadad, head of research in
engineering at Armis, said.

Organizations deploying impacted Avaya and Aruba devices are
highly recommended to apply the patches to mitigate any potential
exploit attempts.