Google security engineer Sven Blumenstein recently found 26 security flaws in products from Aruba Networks. He published his findings late last week, noting that “the vulnerabilities were discovered during a black box security assessment and therefore the vulnerability list should not be considered exhaustive.”

The vulnerabilities will affect a wide range of Aruba products, including ArubaOS, the AirWave Management Platform and Aruba instant access points (IAP). Some, but not all, of the deficiencies named were addressed in recent software updates.

PAPI Is the Problem

Many of the problems that Blumenstein found were caused by the proprietary PAPI protocol that Aruba developed in 2003. Several of the high-severity flaws that could lead to system compromise are directly related to the protocol.

According to SecurityWeek, the AirWave management system flaws include exposure of the RabbitMQ management interface, a weak calculation algorithm for the cross-site request forgery (CSRF) token, a code/command injection flaw and an authentication bypass issue. Meanwhile, Aruba’s IAP software suffered from the transmission of login credentials via HTTP, remote code execution flaws, firmware-related weaknesses, security bugs and more.

Aruba Networks issued an advisory about how to deal with the problems, which have been given the identifiers CVE-2016-2031 (for IAP problems) and CVE-2016-2032 (for Airwave issues).

“The PAPI protocol contains a number of unremediated flaws, including: MD5 message digests are not properly validated upon receipt, PAPI encryption protocol is weak [and] all Aruba devices use a common static key for message validation,” the advisory stated.

Working on Security Flaws

While the company intends to do something about the deficiencies, it’s going to take time. For example, a new control protocol based on Datagram Transport Layer Security (DTLS), a standard security protocol used for protecting some forms of communication, will be applied to IAP products. The hope is that clusters can be deployed on potentially hostile networks without the risks stemming from the current PAPI protocol.

Aruba thinks it will take until 3Q 2016 to complete the protocol changes. Until then, it offers some mediation ideas in the advisory it issued. However, this may be of little comfort to security professionals, many of whom have been hotly debating security flaws in wireless access management programs and are more focused on access management measures than ever before.