High severity · published Sep 17, 2024
CVE-2024-42503
Authenticated Remote Command Execution (RCE) Vulnerability in the Lua Package Within the AOS Command Line Interface (CLI)
7.2
CVSS
1.5%
EPSS
No
On KEV
Description
Authenticated command execution vulnerability exist in the ArubaOS command line interface (CLI). Successful exploitation of this vulnerabilities result in the ability to run arbitrary commands as a priviledge user on the underlying operating system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AO
Aruba OS · Hewlett Packard Enterprise (HPE)
Version 10.6.0.0: 10.6.0.2 and below through <=10.6.0.2; Version 8.10.0.0: 8.10.0.13 and below through <=8.10.0.13; Version 10.5.0.0: 10.6.0.0 and below through <=10.6.0.0; Version 10.3.0.0: 10.4.0.0 and below through <=10.4.0.0; Version 8.11.0.0: 8.12.0.0 and below through <=8.12.0.0; Version 8.12.0.0: 8.12.0.1 and below through <=8.12.0.1; +1 more · source: vendor
AR
Arubaos · Arubanetworks
10.3.0.0 before 10.4.0.0; 10.5.0.0 before 10.6.0.0; 10.6.0.0 through 10.6.0.2; 6.5.4.0 before 6.5.5.0; 8.6.0.0 through 8.10.0.13 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-42503
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-42503
support.hpe.com
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04709en_us&docLocale=en_US
More from Aruba OS
9.8
CVE-2024-42507
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
9.8
CVE-2024-42506
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
9.8
CVE-2024-42505
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
7.2
CVE-2024-42502
Authenticated Remote Command Execution (RCE) Vulnerability in the AOS Command Line Interface
7.2
CVE-2024-42501
Authenticated Path Traversal Vulnerability Leads to a Remote Command Execution (RCE)