CVE-2024-42502

Authenticated Remote Command Execution (RCE) Vulnerability in the AOS Command Line Interface

State: Published
Severity: 7.2 High
Published: Sep 17, 2024
Updated: Sep 18, 2024
Reserved: Aug 2, 2024

Description

Authenticated command injection vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability result in the ability to inject shell commands on the underlying operating system.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	hpe

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Aruba OSHewlett Packard Enterprise (HPE)	Version 10.6.0.0: 10.6.0.2 and below through <=10.6.0.2Affected Version 8.10.0.0: 8.10.0.13 and below through <=8.10.0.13Affected Version 10.5.0.0: 10.6.0.0 and below through <=10.6.0.0Affected Version 10.3.0.0: 10.4.0.0 and below through <=10.4.0.0Affected Version 8.11.0.0: 8.12.0.0 and below through <=8.12.0.0Affected Version 8.12.0.0: 8.12.0.1 and below through <=8.12.0.1Affected Version 6.5.4.0: 8.9.0.0 and below through <=8.9.0.0Affected

Product

Versions

Aruba OSHewlett Packard Enterprise (HPE)

Version 10.6.0.0: 10.6.0.2 and below through <=10.6.0.2Affected
Version 8.10.0.0: 8.10.0.13 and below through <=8.10.0.13Affected
Version 10.5.0.0: 10.6.0.0 and below through <=10.6.0.0Affected
Version 10.3.0.0: 10.4.0.0 and below through <=10.4.0.0Affected
Version 8.11.0.0: 8.12.0.0 and below through <=8.12.0.0Affected
Version 8.12.0.0: 8.12.0.1 and below through <=8.12.0.1Affected
Version 6.5.4.0: 8.9.0.0 and below through <=8.9.0.0Affected

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04709en_us&docLocale=en_US

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.