How severe is CVE-2021-29149?

CVE-2021-29149 has a CVSS 3.x base score of 6.2, rated medium severity. It is exploitable over physical access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2021-29149 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-29149?

CVE-2021-29149 affects Arubanetworks Aos-cx Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-29149?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-29149 published?

CVE-2021-29149 was published on 2021-07-22 and last updated on 2026-06-17.

CVE-2021-29149

CVE-2021-29149 is a medium-severity vulnerability in Arubanetworks Aos-cx Firmware with a CVSS 3.x base score of 6.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 6.2)
CVSS v2: 4.6
EPSS exploit prediction: 0% (16th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Arubanetworks Aos-cx Firmware
Published: 2021-07-22
Last modified: 2026-06-17

Description

A local bypass security restrictions vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): Aruba AOS-CX firmware: 10.04.xxxx - versions prior to 10.04.3070, 10.05.xxxx - versions prior to 10.05.0070, 10.06.xxxx - versions prior to 10.06.0110, 10.07.xxxx - versions prior to 10.07.0001. Aruba has released upgrades for Aruba AOS-CX devices that address this security vulnerability.

Frequently asked questions

What is CVE-2021-29149?: A local bypass security restrictions vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch Series version(s): Aruba AOS-CX firmware: 10.04.xxxx - versions prior to 10.04.3070, 10.05.xxxx - versions prior to 10.05.0070, 10.06.xxxx - versions prior to 10.06.0110, 10.07.xxxx - versions prior to 10.07.0001. Aruba has released upgrades for Aruba AOS-CX devices that address this security vulnerability.
How severe is CVE-2021-29149?: CVE-2021-29149 has a CVSS 3.x base score of 6.2, rated medium severity. It is exploitable over physical access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2021-29149 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-29149?: CVE-2021-29149 affects Arubanetworks Aos-cx Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-29149?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-29149 published?: CVE-2021-29149 was published on 2021-07-22 and last updated on 2026-06-17.

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-013.txt

Affected products (1)

cpe:2.3:o:arubanetworks:aos-cx_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Arubanetworks Aos-cx Firmware

CVE-2021-29143 — High (CVSS 7.2): A remote execution of arbitrary commands vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300…
CVE-2021-29148 — Medium (CVSS 6.1): A local cross-site scripting (XSS) vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch…

All CVEs affecting Arubanetworks Aos-cx Firmware →