CVE-2018-7082: A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative...

Security readout for executives and security teams

CVE-2018-7082 affects Aruba Instant access points. A logged-in administrator could inject commands and run them on the device operating system. The main business risk is a trusted or compromised admin account turning network infrastructure into a persistence point, including unlogged configuration changes or backdoors. Exposure is limited to environments running Aruba Instant IAP firmware in the vulnerable 4.x, 6.5.x, 8.3.x, or 8.4.x ranges, especially where administrative access is broadly available or admin credentials could be compromised. Treat this as a high-priority infrastructure patching item if Aruba Instant is deployed. It is not described as remotely exploitable without admin access, but compromised admin credentials could lead to durable network-device control and weak auditability. Mitigation focus: Upgrade Aruba Instant to a fixed release named by Aruba.; Check vendor guidance for the exact fixed version in the 8.4.x train.; Restrict administrative access to trusted networks and named administrators..

Prepared

Jun 6, 2026, 20:55 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.