Critical severity · published Sep 24, 2024
CVE-2024-42506
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
9.8
CVSS
1.4%
EPSS
No
On KEV
Description
Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AO
Aruba OS · Hewlett Packard Enterprise (HPE)
Version 10.5.0.0: 10.6.0.2 and below through <=10.6.0.2; Version 10.0.0.0: 10.4.1.13 and below through <=10.4.1.13; Version 6.4.0.0: 8.10.0.13 and below through <=8.10.0.13; Version 8.11.0.0: 8.12.0.1 and below through <=8.12.0.1 · source: vendor
AR
Arubaos · Arubanetworks
10.5.0.0 through 10.6.0.2; 10.0.0.0 through 10.4.1.13; 6.4.0.0 through 8.10.0.13; 8.11.0.0 through 8.12.0.1 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-42506
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-42506
support.hpe.com
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04712en_us&docLocale=en_US
More from Aruba OS
9.8
CVE-2024-42507
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
9.8
CVE-2024-42505
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
7.2
CVE-2024-42503
Authenticated Remote Command Execution (RCE) Vulnerability in the Lua Package Within the AOS Command Line Interface (CLI)
7.2
CVE-2024-42502
Authenticated Remote Command Execution (RCE) Vulnerability in the AOS Command Line Interface
7.2
CVE-2024-42501
Authenticated Path Traversal Vulnerability Leads to a Remote Command Execution (RCE)