9.8
Critical
CVE-2024-42509 Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by…
Description
Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 | Versions not published | |
| arubaos 10.5 | 10.5.0.0 → < 10.7.0.0 | 10.7.0.0 |
| arubaos 10.4 | 10.4.0.0 → 10.4.1.4 | No fix stated |
| arubaos 10.3 | 10.3.0.0 → < 10.4.0.0 | 10.4.0.0 |
| instant 8.12 | 8.12.0.0 → 8.12.0.2 | No fix stated |
| instant 8.11 | 8.11.0.0 → < 8.12.0.0 | 8.12.0.0 |
| instant 8.10 | 8.10.0.0 → 8.10.0.13 | No fix stated |
| instant 8.4 | 8.4.0.0 → < 8.10.0.0 | 8.10.0.0 |
| instant 6.4 | 6.4.0.0 → < 6.6.0.0 | 6.6.0.0 |
Other CVEs of HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10
The 6 CVEs of HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 →
CVE-2024-47464
An authenticated Path Traversal vulnerability exists in Instant AOS-8 and AOS-10
6.8
Medium
CVE-2024-47463
An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface
7.2
High
CVE-2024-47462
An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface
7.2
High
CVE-2024-47461
An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface
7.2
High