This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] ArubaOS fixes 10 vulnerabilities
Aruba is fixing 10 vulnerabilities in ArubaOS, which affect the products Mobility Conductor, Mobility Controllers, WLAN Gateways and SD-WAN Gateways. The fix is available in versions 10.6.0.0, 10.5.1.1, 10.4.1.1, 8.11.2.2 and 8.10.0.11 [1].
An unauthenticated remote attacker can execute code without authorization using the PAPI protocol [1].
The vulnerability is present in product:
- ArubaOS; >=10.5.0.0, <10.5.1.0; >=10.4.0.0, <10.4.1.0; >=8.11.0.0, <8.11.2.1; >=8.10.0.0, <8.10.0.10
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-26305 at cve.org, NVD
- CVE-2024-26304 at cve.org, NVD
- CVE-2024-33512 at cve.org, NVD
- CWE-122 at cwe.mitre.org
The vulnerability was publicly disclosed 30. 5. 2024.
An unauthenticated remote attacker can carry out a DoS attack using the PAPI protocol [1].
The vulnerability is present in product:
- ArubaOS; >=10.5.0.0, <10.5.1.0; >=10.4.0.0, <10.4.1.0; >=8.11.0.0, <8.11.2.1; >=8.10.0.0, <8.10.0.10
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-33513 at cve.org, NVD
- CVE-2024-33514 at cve.org, NVD
- CVE-2024-33515 at cve.org, NVD
- CWE-400 at cwe.mitre.org
The vulnerability was publicly disclosed 30. 4. 2024.
An unauthenticated remote attacker can carry out a DoS attack using the PAPI protocol [1].
The vulnerability is present in product:
- ArubaOS; >=10.5.0.0, <10.5.1.0; >=10.4.0.0, <10.4.1.0; >=8.11.0.0, <8.11.2.1; >=8.10.0.0, <8.10.0.10
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
More information:
- CVE-2024-33516 at cve.org, NVD
- CVE-2024-33517 at cve.org, NVD
- CVE-2024-33518 at cve.org, NVD
- CWE-400 at cwe.mitre.org
The vulnerability was publicly disclosed 30. 4. 2024.
By CESNET, z.s.p.o. Martin Krajči on 20. 5. 2024.