uRPF performs reverse routing lookup on every incoming packet’s source address — if the packet arrived on the wrong interface, it’s spoofed and dropped. When uRPF is disabled (the enterprise wireless default due to asymmetric routing), any host on the L2 segment can claim any source IP unconditionally. This is CWE-290 at Layer 3. Three confirmed attack classes in ArubaOS AOS-8: Smurf amplification (spoofed src → broadcast → victim flood), ICMP Timestamp leak (impersonate trusted management IP → elicit timestamp response), pre-auth reflection (use controller as intermediary). Single-packet pcap signature included. Linux sysctl and Cisco IOS uRPF configuration provided.

EtherLeak is an ICMP information disclosure class that resurfaces across vendors and decades — same root cause, different hardware. IP stacks that trust IP_Total_Length over actual frame length expose NIC DMA ring buffer contents via ICMP Echo. Combined with TTL=0, extraction runs at 1,800 bytes/second with zero IDS alerts, zero firewall logs. Covers full mechanism, threshold math, Suricata detection rules, and Scapy PoC.

Smurf amplification requires three weaknesses simultaneously: no uRPF allows IP source spoofing, directed broadcast forwarding delivers the packet to all VLAN hosts, hosts reply to broadcast ICMP Echo. RFC 2644 fixed router-level directed broadcast. L2 broadcast domains are unaffected — the packet never crosses a router. Enterprise wireless VLANs with 50-100 APs and controllers become 50-100x amplifiers. ICMP processing is pre-authentication: no credentials, no session. Two-machine verification: attacker sends spoofed src=victim to broadcast, victim captures unsolicited Echo Replies. pcap-level proof included.

Three compounding weaknesses in ArubaOS 8.13.2.0 ICMP handler: IP Total Length over-read reads 18 bytes past actual frame data into Ethernet padding (CWE-126); TTL=0 packets are processed and replied to in RFC 791 violation (CWE-1284); ICMP checksums are never validated (CWE-354). TTL=0 makes extraction invisible — routers don’t forward, IDS ignores, firewalls don’t log. 27/27 crafted probes confirmed. On physical AOS-8 hardware with active management traffic, the 18-byte DMA region contains previous frame fragments. CVE-2003-0001 and CVE-2021-3031 accepted on identical mechanism without physical hardware PoC.

ArubaOS 8.13.2.0 ships default-xml-api AAA profile on port 32000/TCP with no authentication. The XML parser processes SYSTEM entity declarations and resolves them outbound. Four independent evidence items: wire-level pcap confirms controller TCP connection to attacker listener, target sshd log shows 127.0.0.1-sourced GET request impossible to produce externally, attacker HTTP server logged three DTD fetches at 02:33/02:36/02:38, nine internal ports confirmed open via dialog success responses. CWE-611. CVSS 9.3 Critical. Bugcrowd closed as theoretical. No fix issued.

ArubaOS 8.13.2.0 does not validate ICMP Echo Request source IPs against MAC/IP bindings or apply uRPF — attacker MAC with victim IP is accepted and replied to (CWE-290). Broadcast source IP (192.168.56.255) causes the controller to reply to ff:ff:ff:ff:ff:ff, delivering the reply to every host on the L2 segment (CWE-406). Two-machine evidence: Parrot OS attacker sends spoofed request, Windows victim receives unsolicited Echo Reply id=0xc101 confirmed in independent pcap. No ICMP request was sent from the victim. RFC 1122 §3.2.2.6 violation. Bugcrowd closed as expected behavior. No fix issued.