by Kastro CVE-2024-26304
Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central — There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code execut…
Description · from the CVE record
There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Affected
ProductAffectedFixed inSource
Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba CentralArubaOS 10.5.x.x: 10.5.1.0 and below–CNA
Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba CentralArubaOS 10.4.x.x: 10.4.1.0 and below–CNA
Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba CentralArubaOS 8.11.x.x: 8.11.2.1 and below–CNA
Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba CentralArubaOS 8.10.x.x: 8.10.0.10 and below–CNA
arubaos8.10.0.0 – < 8.10.0.108.10.0.10CISA-ADP
arubaos10.5.0.0 – < 10.5.1.010.5.1.0CISA-ADP
arubaos10.4.0.0 – < 10.4.1.010.4.1.0CISA-ADP
arubaos8.11.0.0 – < 8.11.2.18.11.2.1CISA-ADP
arubaos10.3.0.0 – < 10.4.0.010.4.0.0CISA-ADP
arubaos8.9.0.0 – < 8.10.0.08.10.0.0CISA-ADP
arubaos8.8.0.0 – < 8.9.0.08.9.0.0CISA-ADP
arubaos8.7.0.0 – < 8.8.0.08.8.0.0CISA-ADP
Scores by source
hpe (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total