CVE-2024-42501

Authenticated Path Traversal Vulnerability Leads to a Remote Command Execution (RCE)

State: Published
Severity: 7.2 High
Published: Sep 17, 2024
Updated: Sep 18, 2024
Reserved: Aug 2, 2024

Description

An authenticated Path Traversal vulnerabilities exists in the ArubaOS. Successful exploitation of this vulnerability allows an attacker to install unsigned packages on the underlying operating system, enabling the threat actor to execute arbitrary code or install implants.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	hpe

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
Aruba OSHewlett Packard Enterprise (HPE)	Version 10.6.0.0: 10.6.0.2 and below through <=10.6.0.2Affected Version 8.10.0.0: 8.10.0.13 and below through <=8.10.0.13Affected Version 10.5.0.0: 10.6.0.0 and below through <=10.6.0.0Affected Version 10.3.0.0: 10.4.0.0 and below through <=10.4.0.0Affected Version 8.11.0.0: 8.12.0.0 and below through <=8.12.0.0Affected Version 8.12.0.0: 8.12.0.1 and below through <=8.12.0.1Affected Version 6.5.4.0: 8.9.0.0 and below through <=8.9.0.0Affected

Product

Versions

Aruba OSHewlett Packard Enterprise (HPE)

Version 10.6.0.0: 10.6.0.2 and below through <=10.6.0.2Affected
Version 8.10.0.0: 8.10.0.13 and below through <=8.10.0.13Affected
Version 10.5.0.0: 10.6.0.0 and below through <=10.6.0.0Affected
Version 10.3.0.0: 10.4.0.0 and below through <=10.4.0.0Affected
Version 8.11.0.0: 8.12.0.0 and below through <=8.12.0.0Affected
Version 8.12.0.0: 8.12.0.1 and below through <=8.12.0.1Affected
Version 6.5.4.0: 8.9.0.0 and below through <=8.9.0.0Affected

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04709en_us&docLocale=en_US

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.