This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] HPE Aruba Networking Access Points fixes 6 vulnerabilities

HPE Aruba Networking fixes 6 vulnerabilities in the Access Points product (Instant AOS-8 and AOS-10), 2 of which are critical. The vulnerabilities are fixed in versions 8.12.0.3 and 8.10.0.14 for Instant AOS and in 10.7.0.0 and 10.4.1.5 for AOS. Information on temporary fixes for the vulnerabilities can be found at [1].

Aruba Networking Access Points - RCE (CVE-2024-42509)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can execute code in the operating system of the affected device by sending specially crafted PAPI packets [1].

The vulnerability is present in products:

  • AOS; >=10.4, <10.4.1.5;
  • Instant AOS; >=8.12, <8.12.0.3; >=8.10, < 8.10.0.14;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2024-42509 at cve.org, NVD
  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 5. 11. 2024.

Aruba Networking Access Points - OS command injection (CVE-2024-47461)
CVSS 7.2 (High)

An authenticated remote attacker can execute commands in the operating system of the affected machine, which may lead to its complete takeover [1].

The vulnerability is present in products:

  • AOS; >=10.4, <10.4.1.5;
  • Instant AOS; >=8.12, <8.12.0.3; >=8.10, < 8.10.0.14;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2024-47461 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 5. 11. 2024.

Aruba Networking Access Points - RCE (CVE-2024-47460)
CVSS 9.0 (Critical)

An unauthenticated remote attacker can execute code in the operating system of the affected device by sending specially crafted PAPI packets [1].

The vulnerability is present in products:

  • AOS; >=10.4, <10.4.1.5;
  • Instant AOS; >=8.12, <8.12.0.3; >=8.10, < 8.10.0.14;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2024-47460 at cve.org, NVD
  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 5. 11. 2024.

Aruba Access Points - RCE (CVE-2024-47462, CVE-2024-47463)
CVSS 7.2 (High)

An authenticated remote attacker can create arbitrary files, which may lead to code execution in the operating system of the affected device [1].

The vulnerability is present in products:

  • AOS; >=10.4, <10.4.1.5;
  • Instant AOS; >=8.12, <8.12.0.3; >=8.10, < 8.10.0.14;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 5. 11. 2024.

Aruba Networking Access Points - arbitrary file read (CVE-2024-47464)
CVSS 6.8 (Medium)

An authenticated remote attacker can view arbitrary files without authorization [1].

The vulnerability is present in products:

  • AOS; >=10.4, <10.4.1.5;
  • Instant AOS; >=8.12, <8.12.0.3; >=8.10, < 8.10.0.14;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

More information:

  • CVE-2024-47464 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 5. 11. 2024.

By CESNET, z.s.p.o. Martin Krajči on 8. 11. 2024.

CESNET, z.s.p.o. Logo