This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] ArubaOS fixes 7 vulnerabilities
Aruba versions 10.5.1.0, 10.4.1.0, 8.11.2.1 and 8.10.0.10 fix 7 vulnerabilities in the ArubaOS product (Mobility Controller, Mobility Conductor and Gateway).
An authenticated remote attacker can execute commands without authorization. As a temporary fix, the command line and the web interface used for management can be restricted to a dedicated layer 2 segment and/or access can be controlled by a firewall at layer 3 or higher [1].
The vulnerability is present in product:
- ArubaOS;<10.5.1.0, >10.5.0.0; <10.4.1.0, >10.3.0.0; <8.11.2.1, >8.11.0.0; <8.10.0.10;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-1356 at cve.org, NVD
- CVE-2024-25611 at cve.org, NVD
- CVE-2024-25612 at cve.org, NVD
- CVE-2024-25613 at cve.org, NVD
- CWE-78 at cwe.mitre.org
The vulnerability was publicly disclosed 5. 3. 2024.
An authenticated remote attacker can delete arbitrary files and potentially cause a DoS attack. As a temporary fix, the command line and the web interface used for management can be restricted to a dedicated layer 2 segment and/or access can be controlled by a firewall at layer 3 or higher [1].
The vulnerability is present in product:
- ArubaOS;<10.5.1.0, >10.5.0.0; <10.4.1.0, >10.3.0.0; <8.11.2.1, >8.11.0.0; <8.10.0.10;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
More information:
- CVE-2024-25614 at cve.org, NVD
- CWE-668 at cwe.mitre.org
The vulnerability was publicly disclosed 5. 3. 2024.
An unauthenticated remote attacker can carry out a DoS attack via the PAPI protocol. As a temporary fix, the enhanced security feature can be enabled for this protocol [1].
The vulnerability is present in product:
- ArubaOS; <10.5.1.0, >10.5.0.0; <10.4.1.0, >10.3.0.0; <8.11.2.1, >8.11.0.0; <8.10.0.10;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
More information:
- CVE-2024-25615 at cve.org, NVD
- CWE-400 at cwe.mitre.org
The vulnerability was publicly disclosed 5. 3. 2024.
An unauthenticated remote attacker can, under certain circumstances, gain unauthorized access to sensitive information [1].
The vulnerability is present in product:
- ArubaOS; <10.5.1.0, >10.5.0.0; <10.4.1.0, >10.3.0.0; <8.11.2.1, >8.11.0.0; <8.10.0.10;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2024-25616 at cve.org, NVD
- CWE-200 at cwe.mitre.org
The vulnerability was publicly disclosed 5. 3. 2024.
By CESNET, z.s.p.o. Martin Krajči on 8. 3. 2024.