by Kastro CVE-2024-42505
Hewlett Packard Enterprise (HPE) Aruba OS — Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
Description · from the CVE record
Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Affected
ProductAffectedFixed inSource
Aruba OSVersion 10.5.0.0: 10.6.0.2 and below – <=10.6.0.2–CNA
Aruba OSVersion 10.0.0.0: 10.4.1.13 and below – <=10.4.1.13–CNA
Aruba OSVersion 6.4.0.0: 8.10.0.13 and below – <=8.10.0.13–CNA
Aruba OSVersion 8.11.0.0: 8.12.0.1 and below – <=8.12.0.1–CNA
arubaos10.5.0.0 – 10.6.0.2–CISA-ADP
arubaos10.0.0.0 – 10.4.1.13–CISA-ADP
arubaos6.4.0.0 – 8.10.0.13–CISA-ADP
arubaos8.11.0.0 – 8.12.0.1–CISA-ADP
Scores by source
hpe (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total