Riskcovery

CVE-2024-42509

Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol

State
Published
Severity
9.8 Critical
Published
Nov 5, 2024
Updated
Nov 9, 2024
Reserved
Aug 2, 2024

Read the record on cve.org

Description

Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hhpe

Weaknesses

  • CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

ProductVersions
HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10Hewlett Packard Enterprise (HPE)
  • AOS-10.4.x.x: 10.4.1.4 and below through <=10.4.1.4Affected
  • Instant AOS-8.12.x.x: 8.12.0.2 and below through <=8.12.0.2Affected
  • Instant AOS-8.10.x.x: 8.10.0.13 and below through <=8.10.0.13Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.