CVE-2017-9001
CVE-2017-9001 is a high-severity vulnerability in Hp Aruba Clearpass Policy Manager with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 3.x base score 8.1)
- CVSS v2: 9.3
- EPSS exploit prediction: 7% (94th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Hp Aruba Clearpass Policy Manager
- Published:
- Last modified:
Description
Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled, an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user to execute arbitrary commands on the underlying operating system with "root" privilege level. This vulnerability is only present when a specific feature has been enabled. The SSH Lockout feature is not enabled by default, so only systems which have enabled this feature are vulnerable.
Frequently asked questions
- What is CVE-2017-9001?
- Aruba ClearPass 6.6.3 and later includes a feature called "SSH Lockout", which causes ClearPass to lock accounts with too many login failures through SSH. When this feature is enabled, an unauthenticated remote command execution vulnerability is present which could allow an unauthenticated user to execute arbitrary commands on the underlying operating system with "root" privilege level. This vulnerability is only present when a specific feature has been enabled. The SSH Lockout feature is not enabled by default, so only systems which have enabled this feature are vulnerable.
- How severe is CVE-2017-9001?
- CVE-2017-9001 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2017-9001 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 7% (94th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2017-9001?
- CVE-2017-9001 affects Hp Aruba Clearpass Policy Manager. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2017-9001?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2017-9001 published?
- CVE-2017-9001 was published on 2018-08-06 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:hp:aruba_clearpass_policy_manager:*:*:*:*:*:*:*:*
More vulnerabilities in Hp Aruba Clearpass Policy Manager
- CVE-2018-7058 — Critical (CVSS 9.8): Aruba ClearPass, all versions of 6.6.x prior to 6.6.9 are affected by an authentication bypass vulnerability, an…
- CVE-2017-5824 — Critical (CVSS 9.8): An unauthenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
- CVE-2018-7059 — High (CVSS 8.8): Aruba ClearPass prior to 6.6.9 has a vulnerability in the API that helps to coordinate cluster actions. An…
- CVE-2017-5826 — High (CVSS 8.8): An authenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
- CVE-2017-5825 — High (CVSS 8.8): A privilege escalation vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.
- CVE-2017-5828 — High (CVSS 8.1): An arbitrary command execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.