by Kastro
Paper/Archive/CVE-2024-25614

CVE-2024-25614

Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers and Campus/Remote Access Points — There is an arbitrary file deletion vulnerability in the CLI used by ArubaOS.

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 43.7.437 × 208.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

There is an arbitrary file deletion vulnerability in the CLI used by ArubaOS. Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to denial-of-service conditions and impact the integrity of the controller.

Affected

ProductAffectedFixed inSource
ArubaOS Wi-Fi Controllers and Campus/Remote Access PointsArubaOS 10.5.x.x: 10.5.0.1 and below–CNA
ArubaOS Wi-Fi Controllers and Campus/Remote Access PointsArubaOS 10.4.x.x: 10.4.0.3 and below–CNA
ArubaOS Wi-Fi Controllers and Campus/Remote Access PointsArubaOS 8.11.x.x: 8.11.2.0 and below–CNA
ArubaOS Wi-Fi Controllers and Campus/Remote Access PointsArubaOS 8.10.x.x: 8.10.0.9 and below–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
hpe (CNA)5.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refarubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt