Search
Find a vulnerability
Search criteria
10 vulnerabilities found for HPE Aruba Networking EdgeConnect SD-WAN by Hewlett Packard Enterprise (HPE)
CVE-2024-41136 (GCVE-0-2024-41136)
Vulnerability from nvd – Published: 2024-07-24 20:05 – Updated: 2024-08-02 04:46
VLAI
Title
Authenticated Command Injection in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface
Summary
An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.3.0 , ≤ 9.3.3.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.2.0 , ≤ 9.2.9.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.1.0 , ≤ 9.1.11.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.0.0 , < 9.1.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
8.0.0 , < 8.0.1
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41136",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-25T13:17:26.089025Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:54:12.192Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:51.624Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n\u003cbr\u003e"
}
],
"value": "An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:05:42.905Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Command Injection in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41136",
"datePublished": "2024-07-24T20:05:42.905Z",
"dateReserved": "2024-07-15T21:54:25.878Z",
"dateUpdated": "2024-08-02T04:46:51.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41135 (GCVE-0-2024-41135)
Vulnerability from nvd – Published: 2024-07-24 20:03 – Updated: 2024-08-02 04:46
VLAI
Title
Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface
Summary
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
8.0.0 , < 8.0.1
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.3.0 , ≤ 9.3.3.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.2.0 , ≤ 9.2.9.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.1.0 , ≤ 9.1.11.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.0.0 , < 9.1.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41135",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-24T20:29:52.555289Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:54:59.908Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:52.383Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise\u003cbr\u003e"
}
],
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:03:45.603Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41135",
"datePublished": "2024-07-24T20:03:45.603Z",
"dateReserved": "2024-07-15T21:54:25.878Z",
"dateUpdated": "2024-08-02T04:46:52.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41134 (GCVE-0-2024-41134)
Vulnerability from nvd – Published: 2024-07-24 20:02 – Updated: 2024-08-02 04:46
VLAI
Title
Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface
Summary
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.3.0 , ≤ 9.3.3.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.2.0 , ≤ 9.2.9.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.1.0 , ≤ 9.1.11.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.0.0 , < 9.1.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
8.0.0 , < 8.0.1
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41134",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-25T14:32:38.222595Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T14:33:02.051Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:51.648Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise\u003cbr\u003e"
}
],
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:02:19.471Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41134",
"datePublished": "2024-07-24T20:02:19.471Z",
"dateReserved": "2024-07-15T21:54:25.877Z",
"dateUpdated": "2024-08-02T04:46:51.648Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41133 (GCVE-0-2024-41133)
Vulnerability from nvd – Published: 2024-07-24 20:00 – Updated: 2024-08-02 04:46
VLAI
Title
Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface
Summary
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.3.0 , ≤ 9.3.3.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.2.0 , ≤ 9.2.9.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.1.0 , ≤ 9.1.11.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.0.0 , < 9.1.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
8.0.0 , < 8.0.1
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41133",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-25T13:42:47.640104Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:53:41.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:52.469Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise\u003cbr\u003e"
}
],
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:00:19.562Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41133",
"datePublished": "2024-07-24T20:00:19.562Z",
"dateReserved": "2024-07-15T21:54:25.877Z",
"dateUpdated": "2024-08-02T04:46:52.469Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-33519 (GCVE-0-2024-33519)
Vulnerability from nvd – Published: 2024-07-24 19:57 – Updated: 2024-08-02 02:36
VLAI
Title
Authenticated Server-Side prototype pollution Leading to Information Disclosure
Summary
A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.3.0 , ≤ 9.3.3.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.2.0 , ≤ 9.2.9.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.1.0 , ≤ 9.1.11.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.0.0 , < 9.1.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
8.0.0 , < 8.0.1
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-33519",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-24T20:23:42.569111Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:55:59.067Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:36:04.211Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise."
}
],
"value": "A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T19:57:27.110Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Server-Side prototype pollution Leading to Information Disclosure",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-33519",
"datePublished": "2024-07-24T19:57:27.110Z",
"dateReserved": "2024-04-23T14:21:30.435Z",
"dateUpdated": "2024-08-02T02:36:04.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41136 (GCVE-0-2024-41136)
Vulnerability from cvelistv5 – Published: 2024-07-24 20:05 – Updated: 2024-08-02 04:46
VLAI
Title
Authenticated Command Injection in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface
Summary
An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.3.0 , ≤ 9.3.3.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.2.0 , ≤ 9.2.9.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.1.0 , ≤ 9.1.11.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.0.0 , < 9.1.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
8.0.0 , < 8.0.1
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41136",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-25T13:17:26.089025Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:54:12.192Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:51.624Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n\u003cbr\u003e"
}
],
"value": "An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:05:42.905Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Command Injection in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41136",
"datePublished": "2024-07-24T20:05:42.905Z",
"dateReserved": "2024-07-15T21:54:25.878Z",
"dateUpdated": "2024-08-02T04:46:51.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41135 (GCVE-0-2024-41135)
Vulnerability from cvelistv5 – Published: 2024-07-24 20:03 – Updated: 2024-08-02 04:46
VLAI
Title
Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface
Summary
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
8.0.0 , < 8.0.1
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.3.0 , ≤ 9.3.3.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.2.0 , ≤ 9.2.9.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.1.0 , ≤ 9.1.11.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.0.0 , < 9.1.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41135",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-24T20:29:52.555289Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:54:59.908Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:52.383Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise\u003cbr\u003e"
}
],
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:03:45.603Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41135",
"datePublished": "2024-07-24T20:03:45.603Z",
"dateReserved": "2024-07-15T21:54:25.878Z",
"dateUpdated": "2024-08-02T04:46:52.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41134 (GCVE-0-2024-41134)
Vulnerability from cvelistv5 – Published: 2024-07-24 20:02 – Updated: 2024-08-02 04:46
VLAI
Title
Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface
Summary
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.3.0 , ≤ 9.3.3.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.2.0 , ≤ 9.2.9.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.1.0 , ≤ 9.1.11.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.0.0 , < 9.1.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
8.0.0 , < 8.0.1
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41134",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-25T14:32:38.222595Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T14:33:02.051Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:51.648Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise\u003cbr\u003e"
}
],
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:02:19.471Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41134",
"datePublished": "2024-07-24T20:02:19.471Z",
"dateReserved": "2024-07-15T21:54:25.877Z",
"dateUpdated": "2024-08-02T04:46:51.648Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41133 (GCVE-0-2024-41133)
Vulnerability from cvelistv5 – Published: 2024-07-24 20:00 – Updated: 2024-08-02 04:46
VLAI
Title
Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface
Summary
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.3.0 , ≤ 9.3.3.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.2.0 , ≤ 9.2.9.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.1.0 , ≤ 9.1.11.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.0.0 , < 9.1.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
8.0.0 , < 8.0.1
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41133",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-25T13:42:47.640104Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:53:41.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:52.469Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise\u003cbr\u003e"
}
],
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:00:19.562Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41133",
"datePublished": "2024-07-24T20:00:19.562Z",
"dateReserved": "2024-07-15T21:54:25.877Z",
"dateUpdated": "2024-08-02T04:46:52.469Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-33519 (GCVE-0-2024-33519)
Vulnerability from cvelistv5 – Published: 2024-07-24 19:57 – Updated: 2024-08-02 02:36
VLAI
Title
Authenticated Server-Side prototype pollution Leading to Information Disclosure
Summary
A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.3.0 , ≤ 9.3.3.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.2.0 , ≤ 9.2.9.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.1.0 , ≤ 9.1.11.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
9.0.0 , < 9.1.0
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | edgeconnect_sd-wan_orchestrator |
Affected:
8.0.0 , < 8.0.1
(semver)
cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-33519",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-24T20:23:42.569111Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:55:59.067Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:36:04.211Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise."
}
],
"value": "A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T19:57:27.110Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Server-Side prototype pollution Leading to Information Disclosure",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-33519",
"datePublished": "2024-07-24T19:57:27.110Z",
"dateReserved": "2024-04-23T14:21:30.435Z",
"dateUpdated": "2024-08-02T02:36:04.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}