High severity · published Dec 3, 2024
CVE-2024-51772
Authenticated Deserialization Vulnerability in ClearPass Policy Manager Web-Based Management Interface Leading to a Remote Command Execution (RCE)
8.0
CVSS
0.5%
EPSS
No
On KEV
Description
An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
HPE Aruba Networking ClearPass Policy Manager · Hewlett Packard Enterprise (HPE)
6.12.0 through 6.12.2; 6.11.0 through 6.11.9 · source: vendor
CP
Clearpass Policy Manager · Arubanetworks
6.11.0 before 6.11.10; 6.12.0 before 6.12.3 · source: NVD, CISA
Affected product
HA
HPE Aruba Networking ClearPass Policy Manager
Hewlett Packard Enterprise (HPE)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-51772
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-51772
Vendor Advisory
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04761en_us&docLocale=en_US
More from HPE Aruba Networking ClearPass Policy Manager
8.8
CVE-2025-25039
Authenticated Remote Command Injection in HPE Aruba Networking ClearPass Policy Manager Web-Based Management Interface
8.8
CVE-2024-51771
Authenticated Remote Code Execution (RCE) via OGNL Injection in HPE Aruba Networking ClearPass Web-Based Management Interface
8.1
CVE-2025-23060
Sensitive Data Exposure Vulnerability in HPE Aruba Networking ClearPass Policy Manager (CPPM)
8.1
CVE-2025-23058
Authenticated Broken Access Control Vulnerability in ClearPass Policy Manager Web-Based Management Interface
7.8
CVE-2026-23599
Local Privilege Escalation Vulnerability in HPE Aruba Networking Clear Pass Policy Manager OnGuard for Linux