Critical severity · published Nov 5, 2024
CVE-2024-47460
Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol
9.0
CVSS
1.4%
EPSS
No
On KEV
Description
Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 · Hewlett Packard Enterprise (HPE)
AOS-10.4.x.x: 10.4.1.4 and below through <=10.4.1.4; Instant AOS-8.12.x.x: 8.12.0.2 and below through <=8.12.0.2; Instant AOS-8.10.x.x: 8.10.0.13 and below through <=8.10.0.13 · source: vendor
AR
Arubaos · Arubanetworks
10.4.0.0 through 10.4.1.4; 10.3.0.0 before 10.4.0.0; 10.5.0.0 before 10.7.0.0 · source: CISA
IN
Instant · Arubanetworks
8.12.0.0 through 8.12.0.2; 8.10.0.0 through 8.10.0.13; 6.4.0.0 before 6.6.0.0; 8.4.0.0 before 8.10.0.0; 8.11.0.0 before 8.12.0.0 · source: CISA
Affected product
HA
HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10
Hewlett Packard Enterprise (HPE)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47460
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47460
support.hpe.com
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us&docLocale=en_US
More from HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10
9.8
CVE-2024-42509
Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol
7.2
CVE-2024-47463
Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE)
7.2
CVE-2024-47462
Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE)
7.2
CVE-2024-47461
Authenticated Arbitrary Remote Command Execution (RCE) in Instant AOS-8 and AOS-10
6.8
CVE-2024-47464
Authenticated Path Traversal Vulnerability Leads to a Remote Unauthorized Access to Files