Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central
En bref
- Source
- NVD
- EPSS
- EPSS 14.62 % · centile 97 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- hpe
- Statut NVD
- Deferred
Description
There is a buffer overflow vulnerability in the underlying Local User Authentication Database service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Faiblesses (CWE)
- CWE-121 — Débordement de tampon sur la pile
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | hpe |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · security-alert@hpe.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2024-31250
- GCVE · GCVE-0-2024-33512
Avis du CERT-FR
- CERTFR-2024-AVI-0359 — Multiples vulnérabilités dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central | affected ArubaOS 10.5.x.x: 10.5.1.0 and below ; affected ArubaOS 10.4.x.x: 10.4.1.0 and below ; affected ArubaOS 8.11.x.x: 8.11.2.1 and below ; affected ArubaOS 8.10.x.x: 8.10.0.10 and below |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |