Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central
En bref
- Source
- NVD
- EPSS
- EPSS 15.16 % · centile 97 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- hpe
- Statut NVD
- Analyzed
Description
There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Faiblesses (CWE)
- CWE-121 — Débordement de tampon sur la pile
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | hpe |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · security-alert@hpe.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2024-23576
- GCVE · GCVE-0-2024-26305
Avis du CERT-FR
- CERTFR-2024-AVI-0359 — Multiples vulnérabilités dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:arubanetworks:sd-wan:8.6.0.4-2.2.0.0:*:*:*:*:*:*:*cpe:2.3:a:arubanetworks:sd-wan:8.6.0.4-2.2.0.7:*:*:*:*:*:*:*cpe:2.3:a:arubanetworks:sd-wan:8.7.0.0-2.3.0.0:*:*:*:*:*:*:*cpe:2.3:a:arubanetworks:sd-wan:8.7.0.0-2.3.0.9:*:*:*:*:*:*:*cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*≥ 6.5.4.0 < 8.10.0.12cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*≥ 8.11.0.0 < 8.11.2.2cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*≥ 10.4.0.0 < 10.4.1.1cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*≥ 10.5.0.0 < 10.5.1.1
Produits affectés
| Produit | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central | affected ArubaOS 10.5.x.x: 10.5.1.0 and below ; affected ArubaOS 10.4.x.x: 10.4.1.0 and below ; affected ArubaOS 8.11.x.x: 8.11.2.1 and below ; affected ArubaOS 8.10.x.x: 8.10.0.10 and below |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |