CVE-2007-4023: Cross-site scripting (XSS) vulnerability in the login CGI program in Aruba Mobility Controller 2.5.4.18 and...

Security readout for executives and security teams

This is an old cross-site scripting issue in the Aruba Mobility Controller login CGI. A remote attacker could inject script or HTML into the login flow on affected versions. The business concern is exposure of legacy wireless controller management surfaces, especially if login pages are reachable beyond tightly controlled administration networks. Likely exposure is limited to organizations still operating very old Aruba Mobility Controller firmware or unsupported FIPS builds. Risk increases if the controller login interface is internet-facing, reachable from guest networks, or broadly accessible inside the enterprise. Treat this as a legacy exposure cleanup item unless discovery finds reachable affected controllers. Because details and severity are incomplete, prioritize asset identification, management-plane isolation, and vendor-guided remediation over emergency response absent exploitation evidence. Mitigation focus: Identify Aruba Mobility Controller versions still in service.; Consult Aruba advisory aid-070907b and current vendor support guidance.; Restrict controller login access to trusted administration networks..

Prepared

Jun 29, 2026, 04:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.