This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] HPE Aruba Networking EdgeConnect SD-WAN Gateways fixes 7 vulnerabilities
Aruba fixes 7 vulnerabilities in the HPE Aruba Networking EdgeConnect SD-WAN Gateways product, which uses ECOS software, with versions 9.5.0.0, 9.4.2.0 and 9.3.4.0 [1]. As a temporary fix for these vulnerabilities, the command line and the web interface intended for management can be restricted to a dedicated layer 2 segment and/or access can be controlled by a firewall at layer 3 or higher. It is also recommended that network traffic related to RADIUS and TACACS management be routed through secure SD-WAN tunnels [1].
An authenticated remote attacker is allowed to execute arbitrary commands in the operating system of the affected device via the web management interface by sending specially crafted HTTP requests. Exploitation of the vulnerability may lead to complete compromise of the affected machine [1].
The vulnerability is present in product:
- Aruba Networking EdgeConnect SD-WAN; <9.3.4.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-33519 at cve.org, NVD
- CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') at cwe.mitre.org
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 23. 7. 2024.
An authenticated remote attacker is allowed to execute arbitrary commands with root privileges in the operating system of the affected device via the command line interface. Exploitation of the vulnerability may lead to complete compromise of the affected machine [1].
The vulnerability is present in product:
- Aruba Networking EdgeConnect SD-WAN; <9.3.4.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-41133 at cve.org, NVD
- CVE-2024-41134 at cve.org, NVD
- CVE-2024-41135 at cve.org, NVD
- CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') at cwe.mitre.org
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 23. 7. 2024.
An authenticated remote attacker is allowed to execute arbitrary commands in the operating system of the affected device via the command line interface [1].
The vulnerability is present in product:
- Aruba Networking EdgeConnect SD-WAN; <9.3.4.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-41136 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 23. 7. 2024.
An unauthenticated remote attacker is, under certain circumstances, allowed to execute arbitrary commands in the operating system of the affected device via OpenSSH [1].
The vulnerability is present in product:
- Aruba Networking EdgeConnect SD-WAN; <9.3.4.0;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
More information:
- CVE-2023-51385 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 23. 7. 2024.
An unauthenticated remote attacker is allowed to carry out a Terrapin attack and thereby weaken the security of the SSH connection between the client and the affected machine [1].
The vulnerability is present in product:
- Aruba Networking EdgeConnect SD-WAN; <9.3.4.0;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
More information:
- CVE-2023-48795 at cve.org, NVD
- CWE-354: Improper Validation of Integrity Check Value at cwe.mitre.org
The vulnerability was publicly disclosed 23. 7. 2024.
By CESNET, z.s.p.o. Martin Krajči on 29. 7. 2024.