← Vulnerability feed

Vulnerability record · CVE-2021-25161 · published 30 March 2021

CVE-2021-25161: Arubanetworks instant cross-site scripting vulnerability

Arubanetworks · Instant

A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.

6.1 CVSS 3.1 Medium EPSS 16% · top 3.1% CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score, v2 4.3
16%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 and below; Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf PatchThird Party Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt Vendor Advisory
http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf PatchThird Party Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt Vendor Advisory

Track CVE-2021-25161 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-37885Arubanetworks arubaos classic buffer overflow vulnerabilityThere are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending special…EPSS 1.5%9.8CVE-2022-37886Arubanetworks arubaos classic buffer overflow vulnerabilityThere are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending special…EPSS 1.5%9.8CVE-2022-37887Arubanetworks arubaos classic buffer overflow vulnerabilityThere are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending special…EPSS 1.7%9.8CVE-2022-37889Arubanetworks arubaos classic buffer overflow vulnerabilityThere are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending special…EPSS 1.7%9.8CVE-2022-37890Arubanetworks arubaos classic buffer overflow vulnerabilityUnauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation res…EPSS 1.2%9.8CVE-2022-37891Arubanetworks arubaos classic buffer overflow vulnerabilityUnauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation res…EPSS 1.2%9.8CVE-2022-37888Arubanetworks arubaos classic buffer overflow vulnerabilityThere are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending special…EPSS 1.7%9.8CVE-2021-37726Arubanetworks aruba instant classic buffer overflow vulnerabilityA remote buffer overflow vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 8.7.x.x: 8.7.0.0 through 8.7.1.2. Aruba ha…EPSS 2.4%

Source: NIST National Vulnerability Database (record CVE-2021-25161), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.