Search
Find a vulnerability
Search criteria
145 vulnerabilities found for instant by arubanetworks
VAR-201910-1493
Vulnerability from variot - Updated: 2024-11-23 21:37Aruba Instant 4.x prior to 6.4.4.8-4.2.4.12, 6.5.x prior to 6.5.4.11, 8.3.x prior to 8.3.0.6, and 8.4.x prior to 8.4.0.1 allows Command injection. Aruba Instant Contains an injection vulnerability.Information may be obtained. ALEAlcatelOmniAccessWirelessAccessPoint is a wireless access point device from ALE France. A security vulnerability exists in ALEAlcatelOmniAccessWirelessAccessPoint. An attacker could exploit the vulnerability to view configuration commands by sending a specially crafted URL. Siemens SCALANCE W1750D is prone to following security vulnerabilities: 1. Multiple information disclosure vulnerabilities 2. Multiple remote command injection vulnerabilities Attackers can exploit these issues to obtain sensitive information, or execute arbitrary commands or arbitrary HTML or script code in the browser of an unsuspecting user within the context of the affected application. This can allow the attacker to steal cookie-based authentication credentials and aid in further attacks. Versions prior to SCALANCE W1750D 8.4.0.1 are vulnerable
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201910-1493",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "instant",
"scope": "gte",
"trust": 1.0,
"vendor": "arubanetworks",
"version": "8.3.0.0"
},
{
"model": "w1750d",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "8.4.0.1"
},
{
"model": "instant",
"scope": "gte",
"trust": 1.0,
"vendor": "arubanetworks",
"version": "8.4.0.0"
},
{
"model": "instant",
"scope": "lt",
"trust": 1.0,
"vendor": "arubanetworks",
"version": "6.5.4.11"
},
{
"model": "instant",
"scope": "lt",
"trust": 1.0,
"vendor": "arubanetworks",
"version": "8.3.0.6"
},
{
"model": "instant",
"scope": "lt",
"trust": 1.0,
"vendor": "arubanetworks",
"version": "4.2.4.12"
},
{
"model": "instant",
"scope": "gte",
"trust": 1.0,
"vendor": "arubanetworks",
"version": "4.0.0.0"
},
{
"model": "instant",
"scope": "lt",
"trust": 1.0,
"vendor": "arubanetworks",
"version": "8.4.0.1"
},
{
"model": "instant",
"scope": "gte",
"trust": 1.0,
"vendor": "arubanetworks",
"version": "6.5.0.0"
},
{
"model": "instant",
"scope": "lt",
"trust": 0.8,
"vendor": "aruba",
"version": "8.4.x"
},
{
"model": "instant",
"scope": "eq",
"trust": 0.8,
"vendor": "aruba",
"version": "8.4.0.1"
},
{
"model": "instant",
"scope": "eq",
"trust": 0.8,
"vendor": "aruba",
"version": "8.3.0.6"
},
{
"model": "instant",
"scope": "eq",
"trust": 0.8,
"vendor": "aruba",
"version": "6.5.4.11"
},
{
"model": "instant",
"scope": "lt",
"trust": 0.8,
"vendor": "aruba",
"version": "8.3.x"
},
{
"model": "instant",
"scope": "eq",
"trust": 0.8,
"vendor": "aruba",
"version": "6.4.4.8-4.2.4.12"
},
{
"model": "w1750d",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "instant",
"scope": "lt",
"trust": 0.8,
"vendor": "aruba",
"version": "4.x"
},
{
"model": "instant",
"scope": "lt",
"trust": 0.8,
"vendor": "aruba",
"version": "6.5.x"
},
{
"model": "alcatel omniaccess wireless access point",
"scope": null,
"trust": 0.6,
"vendor": "ale",
"version": null
},
{
"model": "scalance w1750d",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "0"
},
{
"model": "scalance w1750d",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "8.4.0.1"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06344"
},
{
"db": "BID",
"id": "108374"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-016143"
},
{
"db": "NVD",
"id": "CVE-2018-16417"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:arubanetworks:instant",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:siemens:w1750d_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-016143"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Siemens reported these vulnerabilities to NCCIC.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201903-052"
}
],
"trust": 0.6
},
"cve": "CVE-2018-16417",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2018-16417",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-06344",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2018-16417",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2018-16417",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-16417",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2018-16417",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2019-06344",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201903-052",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2018-16417",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06344"
},
{
"db": "VULMON",
"id": "CVE-2018-16417"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-016143"
},
{
"db": "CNNVD",
"id": "CNNVD-201903-052"
},
{
"db": "NVD",
"id": "CVE-2018-16417"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Aruba Instant 4.x prior to 6.4.4.8-4.2.4.12, 6.5.x prior to 6.5.4.11, 8.3.x prior to 8.3.0.6, and 8.4.x prior to 8.4.0.1 allows Command injection. Aruba Instant Contains an injection vulnerability.Information may be obtained. ALEAlcatelOmniAccessWirelessAccessPoint is a wireless access point device from ALE France. A security vulnerability exists in ALEAlcatelOmniAccessWirelessAccessPoint. An attacker could exploit the vulnerability to view configuration commands by sending a specially crafted URL. Siemens SCALANCE W1750D is prone to following security vulnerabilities:\n1. Multiple information disclosure vulnerabilities\n2. Multiple remote command injection vulnerabilities\nAttackers can exploit these issues to obtain sensitive information, or execute arbitrary commands or arbitrary HTML or script code in the browser of an unsuspecting user within the context of the affected application. This can allow the attacker to steal cookie-based authentication credentials and aid in further attacks. \nVersions prior to SCALANCE W1750D 8.4.0.1 are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-16417"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-016143"
},
{
"db": "CNVD",
"id": "CNVD-2019-06344"
},
{
"db": "BID",
"id": "108374"
},
{
"db": "VULMON",
"id": "CVE-2018-16417"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-16417",
"trust": 3.4
},
{
"db": "ICS CERT",
"id": "ICSA-19-134-07",
"trust": 2.8
},
{
"db": "BID",
"id": "108374",
"trust": 2.0
},
{
"db": "SIEMENS",
"id": "SSA-549547",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2018-016143",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2019-06344",
"trust": 0.6
},
{
"db": "ICS CERT",
"id": "ICSA-19-134-02",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.1716.2",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201903-052",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2018-16417",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06344"
},
{
"db": "VULMON",
"id": "CVE-2018-16417"
},
{
"db": "BID",
"id": "108374"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-016143"
},
{
"db": "CNNVD",
"id": "CNNVD-201903-052"
},
{
"db": "NVD",
"id": "CVE-2018-16417"
}
]
},
"id": "VAR-201910-1493",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06344"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06344"
}
]
},
"last_update_date": "2024-11-23T21:37:16.977000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "ARUBA-PSA-2019-001",
"trust": 0.8,
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt"
},
{
"title": "SSA-549547",
"trust": 0.8,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf"
},
{
"title": "Siemens Security Advisories: Siemens Security Advisory",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=f04f471bbc12c6e00cc683978d7f0589"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2018-16417"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-016143"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-77",
"trust": 1.0
},
{
"problemtype": "CWE-74",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-016143"
},
{
"db": "NVD",
"id": "CVE-2018-16417"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "http://www.securityfocus.com/bid/108374"
},
{
"trust": 2.5,
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-134-07"
},
{
"trust": 1.7,
"url": "https://www.anquanke.com/vul/id/1652568"
},
{
"trust": 1.7,
"url": "https://www.arubanetworks.com/assets/alert/aruba-psa-2019-001.txt"
},
{
"trust": 1.7,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-16417"
},
{
"trust": 1.2,
"url": "https://vigilance.fr/vulnerability/alcatel-lucent-enterprise-omniaccess-wlan-instant-multiple-vulnerabilities-28646"
},
{
"trust": 1.0,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-19-134-07"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-16417"
},
{
"trust": 0.6,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-19-134-02-0"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/80946"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/77.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-06344"
},
{
"db": "VULMON",
"id": "CVE-2018-16417"
},
{
"db": "BID",
"id": "108374"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-016143"
},
{
"db": "CNNVD",
"id": "CNNVD-201903-052"
},
{
"db": "NVD",
"id": "CVE-2018-16417"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-06344"
},
{
"db": "VULMON",
"id": "CVE-2018-16417"
},
{
"db": "BID",
"id": "108374"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-016143"
},
{
"db": "CNNVD",
"id": "CNNVD-201903-052"
},
{
"db": "NVD",
"id": "CVE-2018-16417"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-03-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-06344"
},
{
"date": "2019-10-30T00:00:00",
"db": "VULMON",
"id": "CVE-2018-16417"
},
{
"date": "2019-05-14T00:00:00",
"db": "BID",
"id": "108374"
},
{
"date": "2019-11-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-016143"
},
{
"date": "2019-03-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201903-052"
},
{
"date": "2019-10-30T17:15:11.877000",
"db": "NVD",
"id": "CVE-2018-16417"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-03-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-06344"
},
{
"date": "2020-08-24T00:00:00",
"db": "VULMON",
"id": "CVE-2018-16417"
},
{
"date": "2019-05-14T00:00:00",
"db": "BID",
"id": "108374"
},
{
"date": "2019-11-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-016143"
},
{
"date": "2020-08-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201903-052"
},
{
"date": "2024-11-21T03:52:42.423000",
"db": "NVD",
"id": "CVE-2018-16417"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201903-052"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Aruba Instant Injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-016143"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "command injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201903-052"
}
],
"trust": 0.6
}
}
CVE-2024-47463 (GCVE-0-2024-47463)
Vulnerability from nvd – Published: 2024-11-05 22:59 – Updated: 2024-11-09 04:55
VLAI
EPSS
VEX
Title
Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE)
Summary
An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-08 00:00 UTC
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 |
Affected:
AOS-10.4.x.x: 10.4.1.4 and below , ≤ <=10.4.1.4
(semver)
Affected: Instant AOS-8.12.x.x: 8.12.0.2 and below , ≤ <=8.12.0.2 (semver) Affected: Instant AOS-8.10.x.x: 8.10.0.13 and below , ≤ <=8.10.0.13 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.4
(semver)
Affected: 10.3.0.0 , < 10.4.0.0 (semver) Affected: 10.5.0.0 , < 10.7.0.0 (semver) cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , ≤ 8.12.0.2
(semver)
Affected: 8.10.0.0 , ≤ 8.10.0.13 (semver) Affected: 6.4.0.0 , < 6.6.0.0 (semver) Affected: 8.4.0.0 , < 8.10.0.0 (semver) Affected: 8.11.0.0 , < 8.12.0.0 (semver) cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:* |
Date Public
2024-11-05 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.4",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
},
{
"lessThan": "10.7.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47463",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-09T04:55:52.279Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=10.4.1.4",
"status": "affected",
"version": "AOS-10.4.x.x: 10.4.1.4 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.12.0.2",
"status": "affected",
"version": "Instant AOS-8.12.x.x: 8.12.0.2 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.13",
"status": "affected",
"version": "Instant AOS-8.10.x.x: 8.10.0.13 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-11-05T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eAn arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T22:59:04.966Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04722",
"discovery": "EXTERNAL"
},
"title": "Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE)",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-47463",
"datePublished": "2024-11-05T22:59:04.966Z",
"dateReserved": "2024-09-24T18:13:23.209Z",
"dateUpdated": "2024-11-09T04:55:52.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47462 (GCVE-0-2024-47462)
Vulnerability from nvd – Published: 2024-11-05 22:57 – Updated: 2024-11-09 04:55
VLAI
EPSS
VEX
Title
Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE)
Summary
An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-08 00:00 UTC
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 |
Affected:
AOS-10.4.x.x: 10.4.1.4 and below , ≤ <=10.4.1.4
(semver)
Affected: Instant AOS-8.12.x.x: 8.12.0.2 and below , ≤ <=8.12.0.2 (semver) Affected: Instant AOS-8.10.x.x: 8.10.0.13 and below , ≤ <=8.10.0.13 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.4
(semver)
Affected: 10.3.0.0 , < 10.4.0.0 (semver) Affected: 10.5.0.0 , < 10.7.0.0 (semver) cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , ≤ 8.12.0.2
(semver)
Affected: 8.10.0.0 , ≤ 8.10.0.13 (semver) Affected: 6.4.0.0 , < 6.6.0.0 (semver) Affected: 8.4.0.0 , < 8.10.0.0 (semver) Affected: 8.11.0.0 , < 8.12.0.0 (semver) cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:* |
Date Public
2024-11-05 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.4",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
},
{
"lessThan": "10.7.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47462",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-09T04:55:51.057Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=10.4.1.4",
"status": "affected",
"version": "AOS-10.4.x.x: 10.4.1.4 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.12.0.2",
"status": "affected",
"version": "Instant AOS-8.12.x.x: 8.12.0.2 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.13",
"status": "affected",
"version": "Instant AOS-8.10.x.x: 8.10.0.13 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-11-05T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eAn arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T22:57:44.838Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04722",
"discovery": "EXTERNAL"
},
"title": "Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE)",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-47462",
"datePublished": "2024-11-05T22:57:44.838Z",
"dateReserved": "2024-09-24T18:13:23.209Z",
"dateUpdated": "2024-11-09T04:55:51.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47461 (GCVE-0-2024-47461)
Vulnerability from nvd – Published: 2024-11-05 22:54 – Updated: 2024-11-09 04:55
VLAI
EPSS
VEX
Title
Authenticated Arbitrary Remote Command Execution (RCE) in Instant AOS-8 and AOS-10
Summary
An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying host operating system.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-08 00:00 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 |
Affected:
AOS-10.4.x.x: 10.4.1.4 and below , ≤ <=10.4.1.4
(semver)
Affected: Instant AOS-8.12.x.x: 8.12.0.2 and below , ≤ <=8.12.0.2 (semver) Affected: Instant AOS-8.10.x.x: 8.10.0.13 and below , ≤ <=8.10.0.13 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.4
(semver)
Affected: 10.3.0.0 , < 10.4.0.0 (semver) Affected: 10.5.0.0 , < 10.7.0.0 (semver) cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , ≤ 8.12.0.2
(semver)
Affected: 8.10.0.0 , ≤ 8.10.0.13 (semver) Affected: 6.4.0.0 , < 6.6.0.0 (semver) Affected: 8.4.0.0 , < 8.10.0.0 (semver) Affected: 8.11.0.0 , < 8.12.0.0 (semver) cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:* |
Date Public
2024-11-05 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.4",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
},
{
"lessThan": "10.7.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47461",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-09T04:55:49.787Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=10.4.1.4",
"status": "affected",
"version": "AOS-10.4.x.x: 10.4.1.4 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.12.0.2",
"status": "affected",
"version": "Instant AOS-8.12.x.x: 8.12.0.2 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.13",
"status": "affected",
"version": "Instant AOS-8.10.x.x: 8.10.0.13 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-11-05T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying host operating system."
}
],
"value": "An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying host operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T22:54:12.794Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04722",
"discovery": "EXTERNAL"
},
"title": "Authenticated Arbitrary Remote Command Execution (RCE) in Instant AOS-8 and AOS-10",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-47461",
"datePublished": "2024-11-05T22:54:12.794Z",
"dateReserved": "2024-09-24T18:13:23.209Z",
"dateUpdated": "2024-11-09T04:55:49.787Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47460 (GCVE-0-2024-47460)
Vulnerability from nvd – Published: 2024-11-05 22:46 – Updated: 2024-11-09 04:55
VLAI
EPSS
VEX
Title
Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol
Summary
Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Severity
9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-08 00:00 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 |
Affected:
AOS-10.4.x.x: 10.4.1.4 and below , ≤ <=10.4.1.4
(semver)
Affected: Instant AOS-8.12.x.x: 8.12.0.2 and below , ≤ <=8.12.0.2 (semver) Affected: Instant AOS-8.10.x.x: 8.10.0.13 and below , ≤ <=8.10.0.13 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.4
(semver)
Affected: 10.3.0.0 , < 10.4.0.0 (semver) Affected: 10.5.0.0 , < 10.7.0.0 (semver) cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , ≤ 8.12.0.2
(semver)
Affected: 8.10.0.0 , ≤ 8.10.0.13 (semver) Affected: 6.4.0.0 , < 6.6.0.0 (semver) Affected: 8.4.0.0 , < 8.10.0.0 (semver) Affected: 8.11.0.0 , < 8.12.0.0 (semver) cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:* |
Date Public
2024-11-05 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.4",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
},
{
"lessThan": "10.7.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47460",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-09T04:55:48.527Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=10.4.1.4",
"status": "affected",
"version": "AOS-10.4.x.x: 10.4.1.4 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.12.0.2",
"status": "affected",
"version": "Instant AOS-8.12.x.x: 8.12.0.2 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.13",
"status": "affected",
"version": "Instant AOS-8.10.x.x: 8.10.0.13 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Erik De Jong (bugcrowd.com/erikdejong)"
}
],
"datePublic": "2024-11-05T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eCommand injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba\u0027s Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba\u0027s Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T22:46:26.066Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04722",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-47460",
"datePublished": "2024-11-05T22:46:26.066Z",
"dateReserved": "2024-09-24T18:13:23.208Z",
"dateUpdated": "2024-11-09T04:55:48.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42509 (GCVE-0-2024-42509)
Vulnerability from nvd – Published: 2024-11-05 22:34 – Updated: 2024-11-09 04:55
VLAI
EPSS
VEX
Title
Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol
Summary
Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-08 00:00 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 |
Affected:
AOS-10.4.x.x: 10.4.1.4 and below , ≤ <=10.4.1.4
(semver)
Affected: Instant AOS-8.12.x.x: 8.12.0.2 and below , ≤ <=8.12.0.2 (semver) Affected: Instant AOS-8.10.x.x: 8.10.0.13 and below , ≤ <=8.10.0.13 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.4
(semver)
Affected: 10.3.0.0 , < 10.4.0.0 (semver) Affected: 10.5.0.0 , < 10.7.0.0 (semver) cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , ≤ 8.12.0.2
(semver)
Affected: 8.10.0.0 , ≤ 8.10.0.13 (semver) Affected: 6.4.0.0 , < 6.6.0.0 (semver) Affected: 8.4.0.0 , < 8.10.0.0 (semver) Affected: 8.11.0.0 , < 8.12.0.0 (semver) cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:* |
Date Public
2024-11-05 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.4",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
},
{
"lessThan": "10.7.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42509",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-09T04:55:46.815Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=10.4.1.4",
"status": "affected",
"version": "AOS-10.4.x.x: 10.4.1.4 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.12.0.2",
"status": "affected",
"version": "Instant AOS-8.12.x.x: 8.12.0.2 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.13",
"status": "affected",
"version": "Instant AOS-8.10.x.x: 8.10.0.13 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-11-05T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba\u0027s Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system."
}
],
"value": "Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba\u0027s Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T22:46:54.819Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04722",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-42509",
"datePublished": "2024-11-05T22:34:31.648Z",
"dateReserved": "2024-08-02T17:04:57.632Z",
"dateUpdated": "2024-11-09T04:55:46.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42400 (GCVE-0-2024-42400)
Vulnerability from nvd – Published: 2024-08-06 19:51 – Updated: 2025-03-13 17:20
VLAI
EPSS
VEX
Title
Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol
Summary
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-06 20:27 UTC
Assigner
References
1 reference
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise | HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 |
Affected:
Version 8.12.0.0: 8.12.0.1 and below , ≤ <=8.12.0.1
(semver)
Affected: Version 8.10.0.0: 8.10.0.12 and below , ≤ <=8.10.0.12 (semver) Affected: Version 10.6.0.0: 10.6.0.0 and below , ≤ <=10.6.0.0 (semver) Affected: Version 10.4.0.0: 10.4.1.3 and below , ≤ <=10.4.1.3 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.6.0.0 , < 10.6.0.1
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.6.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , < 10.4.1.2
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , < 8.12.0.2
(semver)
cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , < 8.10.0.13
(semver)
cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.5.0.0 , < 10.6.0.0
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.3.0.0 , < 10.4.0.0
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.11.0.0 , < 8.12.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.7.0.0 , < 8.10.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.4.0.0 , < 8.6.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.4.0.0 , < 6.6.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:* |
Date Public
2024-08-06 19:24
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.6.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.6.0.1",
"status": "affected",
"version": "10.6.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.1.2",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.6.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.7.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.6.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42400",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T20:27:16.617985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-13T17:20:31.058Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"lessThanOrEqual": "\u003c=8.12.0.1",
"status": "affected",
"version": "Version 8.12.0.0: 8.12.0.1 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.12",
"status": "affected",
"version": "Version 8.10.0.0: 8.10.0.12 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=10.6.0.0",
"status": "affected",
"version": "Version 10.6.0.0: 10.6.0.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=10.4.1.3",
"status": "affected",
"version": "Version 10.4.0.0: 10.4.1.3 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-08-06T19:24:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point."
}
],
"value": "Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T19:51:17.264Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04678",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-42400",
"datePublished": "2024-08-06T19:51:17.264Z",
"dateReserved": "2024-07-31T20:37:28.338Z",
"dateUpdated": "2025-03-13T17:20:31.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42399 (GCVE-0-2024-42399)
Vulnerability from nvd – Published: 2024-08-06 19:48 – Updated: 2025-03-13 13:37
VLAI
EPSS
VEX
Title
Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol
Summary
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-06 20:27 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise | HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 |
Affected:
Version 8.12.0.0: 8.12.0.1 and below , ≤ <=8.12.0.1
(semver)
Affected: Version 8.10.0.0: 8.10.0.12 and below , ≤ <=8.10.0.12 (semver) Affected: Version 10.6.0.0: 10.6.0.0 and below , ≤ <=10.6.0.0 (semver) Affected: Version 10.4.0.0: 10.4.1.3 and below , ≤ <=10.4.1.3 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.6.0.0 , < 10.6.0.1
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.6.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , < 10.4.1.2
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , < 8.12.0.2
(semver)
cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , < 8.10.0.13
(semver)
cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.5.0.0 , < 10.6.0.0
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.3.0.0 , < 10.4.0.0
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.11.0.0 , < 8.12.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.7.0.0 , < 8.10.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.4.0.0 , < 8.6.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.4.0.0 , < 6.6.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:* |
Date Public
2024-08-06 19:24
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.6.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.6.0.1",
"status": "affected",
"version": "10.6.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.1.2",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.6.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.7.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.6.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42399",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T20:27:21.784664Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-13T13:37:13.997Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"lessThanOrEqual": "\u003c=8.12.0.1",
"status": "affected",
"version": "Version 8.12.0.0: 8.12.0.1 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.12",
"status": "affected",
"version": "Version 8.10.0.0: 8.10.0.12 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=10.6.0.0",
"status": "affected",
"version": "Version 10.6.0.0: 10.6.0.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=10.4.1.3",
"status": "affected",
"version": "Version 10.4.0.0: 10.4.1.3 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-08-06T19:24:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point."
}
],
"value": "Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T19:48:07.255Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04678",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-42399",
"datePublished": "2024-08-06T19:48:07.255Z",
"dateReserved": "2024-07-31T20:37:28.338Z",
"dateUpdated": "2025-03-13T13:37:13.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42398 (GCVE-0-2024-42398)
Vulnerability from nvd – Published: 2024-08-06 19:37 – Updated: 2025-03-24 21:04
VLAI
EPSS
VEX
Title
Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol
Summary
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-06 19:49 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise | HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 |
Affected:
Version 8.12.0.0: 8.12.0.1 and below , ≤ <=8.12.0.1
(semver)
Affected: Version 8.10.0.0: 8.10.0.12 and below , ≤ <=8.10.0.12 (semver) Affected: Version 10.6.0.0: 10.6.0.0 and below , ≤ <=10.6.0.0 (semver) Affected: Version 10.4.0.0: 10.4.1.3 and below , ≤ <=10.4.1.3 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.6.0.0 , < 10.6.0.1
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.6.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , < 10.4.1.2
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , < 8.12.0.2
(semver)
cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , < 8.10.0.13
(semver)
cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.5.0.0 , < 10.6.0.0
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.3.0.0 , < 10.4.0.0
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.11.0.0 , < 8.12.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.7.0.0 , < 8.10.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.4.0.0 , < 8.6.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.4.0.0 , < 6.6.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:* |
Date Public
2024-08-06 19:24
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.6.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.6.0.1",
"status": "affected",
"version": "10.6.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.1.2",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.6.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.7.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.6.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42398",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T19:49:16.243921Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-24T21:04:59.030Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"lessThanOrEqual": "\u003c=8.12.0.1",
"status": "affected",
"version": "Version 8.12.0.0: 8.12.0.1 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.12",
"status": "affected",
"version": "Version 8.10.0.0: 8.10.0.12 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=10.6.0.0",
"status": "affected",
"version": "Version 10.6.0.0: 10.6.0.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=10.4.1.3",
"status": "affected",
"version": "Version 10.4.0.0: 10.4.1.3 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-08-06T19:24:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point."
}
],
"value": "Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T19:38:53.191Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04678",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-42398",
"datePublished": "2024-08-06T19:37:12.816Z",
"dateReserved": "2024-07-31T20:37:28.338Z",
"dateUpdated": "2025-03-24T21:04:59.030Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42396 (GCVE-0-2024-42396)
Vulnerability from nvd – Published: 2024-08-06 18:54 – Updated: 2025-03-25 16:46
VLAI
EPSS
VEX
Title
Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the AP Certificate Management Service Accessed by the PAPI Protocol
Summary
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-06 20:05 UTC
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 |
Affected:
Version 8.12.0.0: 8.12.0.1 and below , ≤ <=8.12.0.1
(semver)
Affected: Version 8.10.0.0: 8.10.0.12 and below , ≤ <=8.10.0.12 (semver) |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , ≤ 8.10.0.12
(semver)
Affected: 8.12.0.0 , ≤ 8.12.0.1 (semver) cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:* |
Date Public
2024-08-06 19:16
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.10.0.12",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.12.0.1",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42396",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T20:05:29.572011Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-25T16:46:21.354Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=8.12.0.1",
"status": "affected",
"version": "Version 8.12.0.0: 8.12.0.1 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.12",
"status": "affected",
"version": "Version 8.10.0.0: 8.10.0.12 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-08-06T19:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMultiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.\u003c/p\u003e"
}
],
"value": "Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T19:41:51.479Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04678",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the AP Certificate Management Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-42396",
"datePublished": "2024-08-06T18:54:42.859Z",
"dateReserved": "2024-07-31T20:37:28.338Z",
"dateUpdated": "2025-03-25T16:46:21.354Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42395 (GCVE-0-2024-42395)
Vulnerability from nvd – Published: 2024-08-06 18:56 – Updated: 2024-08-08 14:47
VLAI
EPSS
VEX
Title
Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the AP Certificate Management Service Accessed by the PAPI Protocol
Summary
There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-07 14:51 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 |
Affected:
Version 8.12.0.0: 8.12.0.1 and below , ≤ <=8.12.0.1
(semver)
Affected: Version 8.10.0.0: 8.10.0.12 and below , ≤ <=8.10.0.12 (semver) |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , < 8.12.0.2
(semver)
cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , < 8.10.0.13
(semver)
cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:* |
Date Public
2024-08-06 19:16
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42395",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-07T14:51:10.591351Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-08T14:47:07.721Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=8.12.0.1",
"status": "affected",
"version": "Version 8.12.0.0: 8.12.0.1 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.12",
"status": "affected",
"version": "Version 8.10.0.0: 8.10.0.12 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-08-06T19:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.\u003c/p\u003e"
}
],
"value": "There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T19:42:44.319Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04678",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the AP Certificate Management Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-42395",
"datePublished": "2024-08-06T18:56:05.348Z",
"dateReserved": "2024-07-31T20:37:28.338Z",
"dateUpdated": "2024-08-08T14:47:07.721Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42393 (GCVE-0-2024-42393)
Vulnerability from nvd – Published: 2024-08-06 18:58 – Updated: 2024-08-12 16:00
VLAI
EPSS
VEX
Title
Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the Soft AP Daemon Service Accessed by the PAPI Protocol
Summary
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-06 19:13 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 |
Affected:
Version 8.12.0.0: 8.12.0.1 and below , ≤ <=8.12.0.1
(semver)
Affected: Version 8.10.0.0: 8.10.0.12 and below , ≤ <=8.10.0.12 (semver) |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , ≤ 8.10.0.12
(semver)
Affected: 8.12.0.0 , ≤ 8.12.0.1 (semver) cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:* |
Date Public
2024-08-06 19:18
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.10.0.12",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.12.0.1",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42393",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T19:13:40.644282Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-12T16:00:36.388Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=8.12.0.1",
"status": "affected",
"version": "Version 8.12.0.0: 8.12.0.1 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.12",
"status": "affected",
"version": "Version 8.10.0.0: 8.10.0.12 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-08-06T19:18:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.\u003c/p\u003e"
}
],
"value": "There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T19:44:56.016Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04678",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the Soft AP Daemon Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-42393",
"datePublished": "2024-08-06T18:58:52.509Z",
"dateReserved": "2024-07-31T20:37:28.337Z",
"dateUpdated": "2024-08-12T16:00:36.388Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-31483 (GCVE-0-2024-31483)
Vulnerability from nvd – Published: 2024-05-14 22:37 – Updated: 2025-06-24 15:23
VLAI
EPSS
VEX
Summary
An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-15 13:43 UTC
Assigner
References
2 references
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | AOS-8 Instant and AOS-10 AP |
Affected:
10.5.0.0 , ≤ 10.5.1.0
(semver)
Affected: 10.4.0.0 , ≤ 10.4.1.0 (semver) Affected: 8.11.0.0 , ≤ 8.11.2.1 (semver) Affected: 8.10.0.0 , ≤ 8.10.0.10 (semver) Affected: 8.6.0.0 , ≤ 8.6.0.23 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.5.0.0 , ≤ 10.5.1.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , ≤ 8.10.0.10
(custom)
cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.11.0.0 , ≤ 8.11.2.1
(custom)
cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.6.0.0 , ≤ 8.6.0.23
(custom)
cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.3.0.0 , < 10.4.0.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.9.0.0 , < 8.10.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.8.0.0 , < 8.9.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.5.0.0 , < 8.6.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.7.0.0 , < 8.8.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.4.0.0 , < 8.5.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.5.0.0 , < 6.6.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.4.0.0 , < 6.5.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.5.1.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.0",
"status": "affected",
"version": "10.4.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.10.0.10",
"status": "affected",
"version": "8.10.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.11.2.1",
"status": "affected",
"version": "8.11.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.6.0.23",
"status": "affected",
"version": "8.6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.9.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.9.0.0",
"status": "affected",
"version": "8.8.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.6.0.0",
"status": "affected",
"version": "8.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.8.0.0",
"status": "affected",
"version": "8.7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.5.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.5.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-31483",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-15T13:43:52.164471Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-31T15:12:51.026Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:52:57.245Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AOS-8 Instant and AOS-10 AP",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "10.5.1.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.4.1.0",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.11.2.1",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.10",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.6.0.23",
"status": "affected",
"version": "8.6.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Chancen"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system.\u003c/p\u003e"
}
],
"value": "An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-24T15:23:49.047Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04647",
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-31483",
"datePublished": "2024-05-14T22:37:06.652Z",
"dateReserved": "2024-04-03T21:21:22.898Z",
"dateUpdated": "2025-06-24T15:23:49.047Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-31482 (GCVE-0-2024-31482)
Vulnerability from nvd – Published: 2024-05-14 22:36 – Updated: 2025-06-24 15:22
VLAI
EPSS
VEX
Summary
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected Access Point.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-15 13:43 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | AOS-8 Instant and AOS-10 AP |
Affected:
10.5.0.0 , ≤ 10.5.1.0
(semver)
Affected: 10.4.0.0 , ≤ 10.4.1.0 (semver) Affected: 8.11.0.0 , ≤ 8.11.2.1 (semver) Affected: 8.10.0.0 , ≤ 8.10.0.10 (semver) Affected: 8.6.0.0 , ≤ 8.6.0.23 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.5.0.0 , ≤ 10.5.1.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , ≤ 8.10.0.10
(custom)
cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.11.0.0 , ≤ 8.11.2.1
(custom)
cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.6.0.0 , ≤ 8.6.0.23
(custom)
cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.3.0.0 , < 10.4.0.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.9.0.0 , < 8.10.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.8.0.0 , < 8.9.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.5.0.0 , < 8.6.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.7.0.0 , < 8.8.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.4.0.0 , < 8.5.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.5.0.0 , < 6.6.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.4.0.0 , < 6.5.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.5.1.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.0",
"status": "affected",
"version": "10.4.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.10.0.10",
"status": "affected",
"version": "8.10.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.11.2.1",
"status": "affected",
"version": "8.11.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.6.0.23",
"status": "affected",
"version": "8.6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.9.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.9.0.0",
"status": "affected",
"version": "8.8.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.6.0.0",
"status": "affected",
"version": "8.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.8.0.0",
"status": "affected",
"version": "8.7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.5.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.5.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-31482",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-15T13:43:20.652798Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-06T17:01:42.878Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:52:57.280Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AOS-8 Instant and AOS-10 AP",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "10.5.1.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.4.1.0",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.11.2.1",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.10",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.6.0.23",
"status": "affected",
"version": "8.6.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Chancen"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected Access Point.\u003c/p\u003e"
}
],
"value": "An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected Access Point."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-24T15:22:57.371Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04647",
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-31482",
"datePublished": "2024-05-14T22:36:10.770Z",
"dateReserved": "2024-04-03T21:21:22.898Z",
"dateUpdated": "2025-06-24T15:22:57.371Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-31481 (GCVE-0-2024-31481)
Vulnerability from nvd – Published: 2024-05-14 22:35 – Updated: 2025-06-24 15:21
VLAI
EPSS
VEX
Summary
Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-15 13:42 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | AOS-8 Instant and AOS-10 AP |
Affected:
10.5.0.0 , ≤ 10.5.1.0
(semver)
Affected: 10.4.0.0 , ≤ 10.4.1.0 (semver) Affected: 8.11.0.0 , ≤ 8.11.2.1 (semver) Affected: 8.10.0.0 , ≤ 8.10.0.10 (semver) Affected: 8.6.0.0 , ≤ 8.6.0.23 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.5.0.0 , ≤ 10.5.1.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , ≤ 8.10.0.10
(custom)
cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.11.0.0 , ≤ 8.11.2.1
(custom)
cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.6.0.0 , ≤ 8.6.0.23
(custom)
cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.3.0.0 , < 10.4.0.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.9.0.0 , < 8.10.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.8.0.0 , < 8.9.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.5.0.0 , < 8.6.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.7.0.0 , < 8.8.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.4.0.0 , < 8.5.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.5.0.0 , < 6.6.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.4.0.0 , < 6.5.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.5.1.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.0",
"status": "affected",
"version": "10.4.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.10.0.10",
"status": "affected",
"version": "8.10.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.11.2.1",
"status": "affected",
"version": "8.11.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.6.0.23",
"status": "affected",
"version": "8.6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.9.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.9.0.0",
"status": "affected",
"version": "8.8.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.6.0.0",
"status": "affected",
"version": "8.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.8.0.0",
"status": "affected",
"version": "8.7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.5.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.5.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-31481",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-15T13:42:47.657209Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-06T17:01:20.265Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:52:57.107Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AOS-8 Instant and AOS-10 AP",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "10.5.1.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.4.1.0",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.11.2.1",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.10",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.6.0.23",
"status": "affected",
"version": "8.6.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Chancen"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUnauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.\u003c/p\u003e"
}
],
"value": "Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-24T15:21:48.806Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04647",
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-31481",
"datePublished": "2024-05-14T22:35:29.359Z",
"dateReserved": "2024-04-03T21:21:22.898Z",
"dateUpdated": "2025-06-24T15:21:48.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-31480 (GCVE-0-2024-31480)
Vulnerability from nvd – Published: 2024-05-14 22:34 – Updated: 2025-06-24 15:19
VLAI
EPSS
VEX
Summary
Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-15 13:42 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | AOS-8 Instant and AOS-10 AP |
Affected:
10.5.0.0 , ≤ 10.5.1.0
(semver)
Affected: 10.4.0.0 , ≤ 10.4.1.0 (semver) Affected: 8.11.0.0 , ≤ 8.11.2.1 (semver) Affected: 8.10.0.0 , ≤ 8.10.0.10 (semver) Affected: 8.6.0.0 , ≤ 8.6.0.23 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.5.0.0 , ≤ 10.5.1.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , ≤ 8.10.0.10
(custom)
cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.11.0.0 , ≤ 8.11.2.1
(custom)
cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.6.0.0 , ≤ 8.6.0.23
(custom)
cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.3.0.0 , < 10.4.0.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.9.0.0 , < 8.10.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.8.0.0 , < 8.9.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.5.0.0 , < 8.6.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.7.0.0 , < 8.8.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.4.0.0 , < 8.5.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.5.0.0 , < 6.6.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.4.0.0 , < 6.5.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.5.1.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.0",
"status": "affected",
"version": "10.4.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.10.0.10",
"status": "affected",
"version": "8.10.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.11.2.1",
"status": "affected",
"version": "8.11.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.6.0.23",
"status": "affected",
"version": "8.6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.9.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.9.0.0",
"status": "affected",
"version": "8.8.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.6.0.0",
"status": "affected",
"version": "8.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.8.0.0",
"status": "affected",
"version": "8.7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.5.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.5.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-31480",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-15T13:42:01.200373Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-06T17:01:00.228Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:52:57.134Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AOS-8 Instant and AOS-10 AP",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "10.5.1.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.4.1.0",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.11.2.1",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.10",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.6.0.23",
"status": "affected",
"version": "8.6.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Chancen"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUnauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.\u003c/p\u003e"
}
],
"value": "Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-24T15:19:49.638Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04647",
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-31480",
"datePublished": "2024-05-14T22:34:42.949Z",
"dateReserved": "2024-04-03T21:21:22.898Z",
"dateUpdated": "2025-06-24T15:19:49.638Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-31479 (GCVE-0-2024-31479)
Vulnerability from nvd – Published: 2024-05-14 22:33 – Updated: 2025-06-24 15:17
VLAI
EPSS
VEX
Summary
Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-15 13:25 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | AOS-8 Instant and AOS-10 AP |
Affected:
10.5.0.0 , ≤ 10.5.1.0
(semver)
Affected: 10.4.0.0 , ≤ 10.4.1.0 (semver) Affected: 8.11.0.0 , ≤ 8.11.2.1 (semver) Affected: 8.10.0.0 , ≤ 8.10.0.10 (semver) Affected: 8.6.0.0 , ≤ 8.6.0.23 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.5.0.0 , ≤ 10.5.1.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , ≤ 8.10.0.10
(custom)
cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.11.0.0 , ≤ 8.11.2.1
(custom)
cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.6.0.0 , ≤ 8.6.0.23
(custom)
cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.3.0.0 , < 10.4.0.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.9.0.0 , < 8.10.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.8.0.0 , < 8.9.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.5.0.0 , < 8.6.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.7.0.0 , < 8.8.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.4.0.0 , < 8.5.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.5.0.0 , < 6.6.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.4.0.0 , < 6.5.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.5.1.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.0",
"status": "affected",
"version": "10.4.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.10.0.10",
"status": "affected",
"version": "8.10.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.11.2.1",
"status": "affected",
"version": "8.11.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.6.0.23",
"status": "affected",
"version": "8.6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.9.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.9.0.0",
"status": "affected",
"version": "8.8.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.6.0.0",
"status": "affected",
"version": "8.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.8.0.0",
"status": "affected",
"version": "8.7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.5.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.5.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-31479",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-15T13:25:35.184663Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-06T17:00:39.087Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:52:57.116Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AOS-8 Instant and AOS-10 AP",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "10.5.1.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.4.1.0",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.11.2.1",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.10",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.6.0.23",
"status": "affected",
"version": "8.6.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Chancen"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUnauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.\u003c/p\u003e"
}
],
"value": "Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-24T15:17:14.638Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04647",
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-31479",
"datePublished": "2024-05-14T22:33:38.302Z",
"dateReserved": "2024-04-03T21:21:22.898Z",
"dateUpdated": "2025-06-24T15:17:14.638Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-31478 (GCVE-0-2024-31478)
Vulnerability from nvd – Published: 2024-05-14 22:32 – Updated: 2025-06-24 15:01
VLAI
EPSS
VEX
Summary
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilites result in the ability to interrupt the normal operation of the affected Access Point.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-15 13:41 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | AOS-8 Instant and AOS-10 AP |
Affected:
10.5.0.0 , ≤ 10.5.1.0
(semver)
Affected: 10.4.0.0 , ≤ 10.4.1.0 (semver) Affected: 8.11.0.0 , ≤ 8.11.2.1 (semver) Affected: 8.10.0.0 , ≤ 8.10.0.10 (semver) Affected: 8.6.0.0 , ≤ 8.6.0.23 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.5.0.0 , ≤ 10.5.1.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , ≤ 8.10.0.10
(custom)
cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.11.0.0 , ≤ 8.11.2.1
(custom)
cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.6.0.0 , ≤ 8.6.0.23
(custom)
cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.3.0.0 , < 10.4.0.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.9.0.0 , < 8.10.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.8.0.0 , < 8.9.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.5.0.0 , < 8.6.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.7.0.0 , < 8.8.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.4.0.0 , < 8.5.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.5.0.0 , < 6.6.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.4.0.0 , < 6.5.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.5.1.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.0",
"status": "affected",
"version": "10.4.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.10.0.10",
"status": "affected",
"version": "8.10.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.11.2.1",
"status": "affected",
"version": "8.11.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.6.0.23",
"status": "affected",
"version": "8.6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.9.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.9.0.0",
"status": "affected",
"version": "8.8.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.6.0.0",
"status": "affected",
"version": "8.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.8.0.0",
"status": "affected",
"version": "8.7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.5.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.5.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-31478",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-15T13:41:22.094004Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-06T17:00:19.275Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:52:57.134Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AOS-8 Instant and AOS-10 AP",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "10.5.1.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.4.1.0",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.11.2.1",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.10",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.6.0.23",
"status": "affected",
"version": "8.6.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Chancen"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMultiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilites result in the ability to interrupt the normal operation of the affected Access Point.\u003c/p\u003e"
}
],
"value": "Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilites result in the ability to interrupt the normal operation of the affected Access Point."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-24T15:01:43.100Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04647",
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-31478",
"datePublished": "2024-05-14T22:32:51.129Z",
"dateReserved": "2024-04-03T21:21:22.897Z",
"dateUpdated": "2025-06-24T15:01:43.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-31477 (GCVE-0-2024-31477)
Vulnerability from nvd – Published: 2024-05-14 22:32 – Updated: 2025-06-24 15:15
VLAI
EPSS
VEX
Summary
Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-17 04:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
Impacted products
14 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | AOS-8 Instant and AOS-10 AP |
Affected:
10.5.0.0 , ≤ 10.5.1.0
(semver)
Affected: 10.4.0.0 , ≤ 10.4.1.0 (semver) Affected: 8.11.0.0 , ≤ 8.11.2.1 (semver) Affected: 8.10.0.0 , ≤ 8.10.0.10 (semver) Affected: 8.6.0.0 , ≤ 8.6.0.23 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.5.0.0 , ≤ 10.5.1.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , ≤ 8.10.0.10
(custom)
cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.11.0.0 , ≤ 8.11.2.1
(custom)
cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.6.0.0 , ≤ 8.6.0.23
(custom)
cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.3.0.0 , < 10.4.0.0
(custom)
cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.9.0.0 , < 8.10.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.8.0.0 , < 8.9.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.5.0.0 , < 8.6.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.7.0.0 , < 8.8.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.4.0.0 , < 8.5.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.5.0.0 , < 6.6.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.4.0.0 , < 6.5.0.0
(custom)
cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.5.1.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.0",
"status": "affected",
"version": "10.4.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.10.0.10",
"status": "affected",
"version": "8.10.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.11.2.1",
"status": "affected",
"version": "8.11.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.6.0.23",
"status": "affected",
"version": "8.6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.9.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.9.0.0",
"status": "affected",
"version": "8.8.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.6.0.0",
"status": "affected",
"version": "8.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.8.0.0",
"status": "affected",
"version": "8.7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.5.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.5.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-31477",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-17T04:00:34.951992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-06T16:59:03.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:52:57.111Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AOS-8 Instant and AOS-10 AP",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "10.5.1.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.4.1.0",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.11.2.1",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.10",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.6.0.23",
"status": "affected",
"version": "8.6.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Erik De Jong (bugcrowd.com/erikdejong)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMultiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\u003c/p\u003e"
}
],
"value": "Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-24T15:15:50.694Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04647",
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-31477",
"datePublished": "2024-05-14T22:32:06.557Z",
"dateReserved": "2024-04-03T21:21:22.897Z",
"dateUpdated": "2025-06-24T15:15:50.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47463 (GCVE-0-2024-47463)
Vulnerability from cvelistv5 – Published: 2024-11-05 22:59 – Updated: 2024-11-09 04:55
VLAI
EPSS
VEX
Title
Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE)
Summary
An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-08 00:00 UTC
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 |
Affected:
AOS-10.4.x.x: 10.4.1.4 and below , ≤ <=10.4.1.4
(semver)
Affected: Instant AOS-8.12.x.x: 8.12.0.2 and below , ≤ <=8.12.0.2 (semver) Affected: Instant AOS-8.10.x.x: 8.10.0.13 and below , ≤ <=8.10.0.13 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.4
(semver)
Affected: 10.3.0.0 , < 10.4.0.0 (semver) Affected: 10.5.0.0 , < 10.7.0.0 (semver) cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , ≤ 8.12.0.2
(semver)
Affected: 8.10.0.0 , ≤ 8.10.0.13 (semver) Affected: 6.4.0.0 , < 6.6.0.0 (semver) Affected: 8.4.0.0 , < 8.10.0.0 (semver) Affected: 8.11.0.0 , < 8.12.0.0 (semver) cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:* |
Date Public
2024-11-05 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.4",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
},
{
"lessThan": "10.7.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47463",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-09T04:55:52.279Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=10.4.1.4",
"status": "affected",
"version": "AOS-10.4.x.x: 10.4.1.4 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.12.0.2",
"status": "affected",
"version": "Instant AOS-8.12.x.x: 8.12.0.2 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.13",
"status": "affected",
"version": "Instant AOS-8.10.x.x: 8.10.0.13 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-11-05T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eAn arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T22:59:04.966Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04722",
"discovery": "EXTERNAL"
},
"title": "Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE)",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-47463",
"datePublished": "2024-11-05T22:59:04.966Z",
"dateReserved": "2024-09-24T18:13:23.209Z",
"dateUpdated": "2024-11-09T04:55:52.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47462 (GCVE-0-2024-47462)
Vulnerability from cvelistv5 – Published: 2024-11-05 22:57 – Updated: 2024-11-09 04:55
VLAI
EPSS
VEX
Title
Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE)
Summary
An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-08 00:00 UTC
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 |
Affected:
AOS-10.4.x.x: 10.4.1.4 and below , ≤ <=10.4.1.4
(semver)
Affected: Instant AOS-8.12.x.x: 8.12.0.2 and below , ≤ <=8.12.0.2 (semver) Affected: Instant AOS-8.10.x.x: 8.10.0.13 and below , ≤ <=8.10.0.13 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.4
(semver)
Affected: 10.3.0.0 , < 10.4.0.0 (semver) Affected: 10.5.0.0 , < 10.7.0.0 (semver) cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , ≤ 8.12.0.2
(semver)
Affected: 8.10.0.0 , ≤ 8.10.0.13 (semver) Affected: 6.4.0.0 , < 6.6.0.0 (semver) Affected: 8.4.0.0 , < 8.10.0.0 (semver) Affected: 8.11.0.0 , < 8.12.0.0 (semver) cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:* |
Date Public
2024-11-05 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.4",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
},
{
"lessThan": "10.7.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47462",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-09T04:55:51.057Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=10.4.1.4",
"status": "affected",
"version": "AOS-10.4.x.x: 10.4.1.4 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.12.0.2",
"status": "affected",
"version": "Instant AOS-8.12.x.x: 8.12.0.2 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.13",
"status": "affected",
"version": "Instant AOS-8.10.x.x: 8.10.0.13 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-11-05T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eAn arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T22:57:44.838Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04722",
"discovery": "EXTERNAL"
},
"title": "Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE)",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-47462",
"datePublished": "2024-11-05T22:57:44.838Z",
"dateReserved": "2024-09-24T18:13:23.209Z",
"dateUpdated": "2024-11-09T04:55:51.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47461 (GCVE-0-2024-47461)
Vulnerability from cvelistv5 – Published: 2024-11-05 22:54 – Updated: 2024-11-09 04:55
VLAI
EPSS
VEX
Title
Authenticated Arbitrary Remote Command Execution (RCE) in Instant AOS-8 and AOS-10
Summary
An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying host operating system.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-08 00:00 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 |
Affected:
AOS-10.4.x.x: 10.4.1.4 and below , ≤ <=10.4.1.4
(semver)
Affected: Instant AOS-8.12.x.x: 8.12.0.2 and below , ≤ <=8.12.0.2 (semver) Affected: Instant AOS-8.10.x.x: 8.10.0.13 and below , ≤ <=8.10.0.13 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.4
(semver)
Affected: 10.3.0.0 , < 10.4.0.0 (semver) Affected: 10.5.0.0 , < 10.7.0.0 (semver) cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , ≤ 8.12.0.2
(semver)
Affected: 8.10.0.0 , ≤ 8.10.0.13 (semver) Affected: 6.4.0.0 , < 6.6.0.0 (semver) Affected: 8.4.0.0 , < 8.10.0.0 (semver) Affected: 8.11.0.0 , < 8.12.0.0 (semver) cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:* |
Date Public
2024-11-05 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.4",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
},
{
"lessThan": "10.7.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47461",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-09T04:55:49.787Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=10.4.1.4",
"status": "affected",
"version": "AOS-10.4.x.x: 10.4.1.4 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.12.0.2",
"status": "affected",
"version": "Instant AOS-8.12.x.x: 8.12.0.2 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.13",
"status": "affected",
"version": "Instant AOS-8.10.x.x: 8.10.0.13 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-11-05T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying host operating system."
}
],
"value": "An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying host operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T22:54:12.794Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04722",
"discovery": "EXTERNAL"
},
"title": "Authenticated Arbitrary Remote Command Execution (RCE) in Instant AOS-8 and AOS-10",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-47461",
"datePublished": "2024-11-05T22:54:12.794Z",
"dateReserved": "2024-09-24T18:13:23.209Z",
"dateUpdated": "2024-11-09T04:55:49.787Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-47460 (GCVE-0-2024-47460)
Vulnerability from cvelistv5 – Published: 2024-11-05 22:46 – Updated: 2024-11-09 04:55
VLAI
EPSS
VEX
Title
Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol
Summary
Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Severity
9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-08 00:00 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 |
Affected:
AOS-10.4.x.x: 10.4.1.4 and below , ≤ <=10.4.1.4
(semver)
Affected: Instant AOS-8.12.x.x: 8.12.0.2 and below , ≤ <=8.12.0.2 (semver) Affected: Instant AOS-8.10.x.x: 8.10.0.13 and below , ≤ <=8.10.0.13 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.4
(semver)
Affected: 10.3.0.0 , < 10.4.0.0 (semver) Affected: 10.5.0.0 , < 10.7.0.0 (semver) cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , ≤ 8.12.0.2
(semver)
Affected: 8.10.0.0 , ≤ 8.10.0.13 (semver) Affected: 6.4.0.0 , < 6.6.0.0 (semver) Affected: 8.4.0.0 , < 8.10.0.0 (semver) Affected: 8.11.0.0 , < 8.12.0.0 (semver) cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:* |
Date Public
2024-11-05 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.4",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
},
{
"lessThan": "10.7.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-47460",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-09T04:55:48.527Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=10.4.1.4",
"status": "affected",
"version": "AOS-10.4.x.x: 10.4.1.4 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.12.0.2",
"status": "affected",
"version": "Instant AOS-8.12.x.x: 8.12.0.2 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.13",
"status": "affected",
"version": "Instant AOS-8.10.x.x: 8.10.0.13 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Erik De Jong (bugcrowd.com/erikdejong)"
}
],
"datePublic": "2024-11-05T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eCommand injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba\u0027s Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba\u0027s Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T22:46:26.066Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04722",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-47460",
"datePublished": "2024-11-05T22:46:26.066Z",
"dateReserved": "2024-09-24T18:13:23.208Z",
"dateUpdated": "2024-11-09T04:55:48.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42509 (GCVE-0-2024-42509)
Vulnerability from cvelistv5 – Published: 2024-11-05 22:34 – Updated: 2024-11-09 04:55
VLAI
EPSS
VEX
Title
Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol
Summary
Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-08 00:00 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10 |
Affected:
AOS-10.4.x.x: 10.4.1.4 and below , ≤ <=10.4.1.4
(semver)
Affected: Instant AOS-8.12.x.x: 8.12.0.2 and below , ≤ <=8.12.0.2 (semver) Affected: Instant AOS-8.10.x.x: 8.10.0.13 and below , ≤ <=8.10.0.13 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , ≤ 10.4.1.4
(semver)
Affected: 10.3.0.0 , < 10.4.0.0 (semver) Affected: 10.5.0.0 , < 10.7.0.0 (semver) cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , ≤ 8.12.0.2
(semver)
Affected: 8.10.0.0 , ≤ 8.10.0.13 (semver) Affected: 6.4.0.0 , < 6.6.0.0 (semver) Affected: 8.4.0.0 , < 8.10.0.0 (semver) Affected: 8.11.0.0 , < 8.12.0.0 (semver) cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:* |
Date Public
2024-11-05 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "10.4.1.4",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
},
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
},
{
"lessThan": "10.7.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
},
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42509",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-09T04:55:46.815Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=10.4.1.4",
"status": "affected",
"version": "AOS-10.4.x.x: 10.4.1.4 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.12.0.2",
"status": "affected",
"version": "Instant AOS-8.12.x.x: 8.12.0.2 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.13",
"status": "affected",
"version": "Instant AOS-8.10.x.x: 8.10.0.13 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-11-05T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba\u0027s Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system."
}
],
"value": "Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba\u0027s Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T22:46:54.819Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04722",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-42509",
"datePublished": "2024-11-05T22:34:31.648Z",
"dateReserved": "2024-08-02T17:04:57.632Z",
"dateUpdated": "2024-11-09T04:55:46.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42400 (GCVE-0-2024-42400)
Vulnerability from cvelistv5 – Published: 2024-08-06 19:51 – Updated: 2025-03-13 17:20
VLAI
EPSS
VEX
Title
Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol
Summary
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-06 20:27 UTC
Assigner
References
1 reference
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise | HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 |
Affected:
Version 8.12.0.0: 8.12.0.1 and below , ≤ <=8.12.0.1
(semver)
Affected: Version 8.10.0.0: 8.10.0.12 and below , ≤ <=8.10.0.12 (semver) Affected: Version 10.6.0.0: 10.6.0.0 and below , ≤ <=10.6.0.0 (semver) Affected: Version 10.4.0.0: 10.4.1.3 and below , ≤ <=10.4.1.3 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.6.0.0 , < 10.6.0.1
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.6.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , < 10.4.1.2
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , < 8.12.0.2
(semver)
cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , < 8.10.0.13
(semver)
cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.5.0.0 , < 10.6.0.0
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.3.0.0 , < 10.4.0.0
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.11.0.0 , < 8.12.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.7.0.0 , < 8.10.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.4.0.0 , < 8.6.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.4.0.0 , < 6.6.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:* |
Date Public
2024-08-06 19:24
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.6.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.6.0.1",
"status": "affected",
"version": "10.6.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.1.2",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.6.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.7.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.6.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42400",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T20:27:16.617985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-13T17:20:31.058Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"lessThanOrEqual": "\u003c=8.12.0.1",
"status": "affected",
"version": "Version 8.12.0.0: 8.12.0.1 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.12",
"status": "affected",
"version": "Version 8.10.0.0: 8.10.0.12 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=10.6.0.0",
"status": "affected",
"version": "Version 10.6.0.0: 10.6.0.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=10.4.1.3",
"status": "affected",
"version": "Version 10.4.0.0: 10.4.1.3 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-08-06T19:24:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point."
}
],
"value": "Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T19:51:17.264Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04678",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-42400",
"datePublished": "2024-08-06T19:51:17.264Z",
"dateReserved": "2024-07-31T20:37:28.338Z",
"dateUpdated": "2025-03-13T17:20:31.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42399 (GCVE-0-2024-42399)
Vulnerability from cvelistv5 – Published: 2024-08-06 19:48 – Updated: 2025-03-13 13:37
VLAI
EPSS
VEX
Title
Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol
Summary
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-06 20:27 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise | HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 |
Affected:
Version 8.12.0.0: 8.12.0.1 and below , ≤ <=8.12.0.1
(semver)
Affected: Version 8.10.0.0: 8.10.0.12 and below , ≤ <=8.10.0.12 (semver) Affected: Version 10.6.0.0: 10.6.0.0 and below , ≤ <=10.6.0.0 (semver) Affected: Version 10.4.0.0: 10.4.1.3 and below , ≤ <=10.4.1.3 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.6.0.0 , < 10.6.0.1
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.6.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , < 10.4.1.2
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , < 8.12.0.2
(semver)
cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , < 8.10.0.13
(semver)
cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.5.0.0 , < 10.6.0.0
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.3.0.0 , < 10.4.0.0
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.11.0.0 , < 8.12.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.7.0.0 , < 8.10.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.4.0.0 , < 8.6.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.4.0.0 , < 6.6.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:* |
Date Public
2024-08-06 19:24
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.6.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.6.0.1",
"status": "affected",
"version": "10.6.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.1.2",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.6.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.7.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.6.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42399",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T20:27:21.784664Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-13T13:37:13.997Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"lessThanOrEqual": "\u003c=8.12.0.1",
"status": "affected",
"version": "Version 8.12.0.0: 8.12.0.1 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.12",
"status": "affected",
"version": "Version 8.10.0.0: 8.10.0.12 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=10.6.0.0",
"status": "affected",
"version": "Version 10.6.0.0: 10.6.0.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=10.4.1.3",
"status": "affected",
"version": "Version 10.4.0.0: 10.4.1.3 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-08-06T19:24:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point."
}
],
"value": "Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T19:48:07.255Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04678",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-42399",
"datePublished": "2024-08-06T19:48:07.255Z",
"dateReserved": "2024-07-31T20:37:28.338Z",
"dateUpdated": "2025-03-13T13:37:13.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42398 (GCVE-0-2024-42398)
Vulnerability from cvelistv5 – Published: 2024-08-06 19:37 – Updated: 2025-03-24 21:04
VLAI
EPSS
VEX
Title
Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol
Summary
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-06 19:49 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise | HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 |
Affected:
Version 8.12.0.0: 8.12.0.1 and below , ≤ <=8.12.0.1
(semver)
Affected: Version 8.10.0.0: 8.10.0.12 and below , ≤ <=8.10.0.12 (semver) Affected: Version 10.6.0.0: 10.6.0.0 and below , ≤ <=10.6.0.0 (semver) Affected: Version 10.4.0.0: 10.4.1.3 and below , ≤ <=10.4.1.3 (semver) |
|
| arubanetworks | arubaos |
Affected:
10.6.0.0 , < 10.6.0.1
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.6.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.4.0.0 , < 10.4.1.2
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , < 8.12.0.2
(semver)
cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , < 8.10.0.13
(semver)
cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.5.0.0 , < 10.6.0.0
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | arubaos |
Affected:
10.3.0.0 , < 10.4.0.0
(semver)
cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.11.0.0 , < 8.12.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.7.0.0 , < 8.10.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.4.0.0 , < 8.6.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
6.4.0.0 , < 6.6.0.0
(semver)
cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:* |
Date Public
2024-08-06 19:24
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.6.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.6.0.1",
"status": "affected",
"version": "10.6.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.1.2",
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.6.0.0",
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "arubaos",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "10.4.0.0",
"status": "affected",
"version": "10.3.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.12.0.0",
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.0",
"status": "affected",
"version": "8.7.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.6.0.0",
"status": "affected",
"version": "8.4.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "6.6.0.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42398",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T19:49:16.243921Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-24T21:04:59.030Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"lessThanOrEqual": "\u003c=8.12.0.1",
"status": "affected",
"version": "Version 8.12.0.0: 8.12.0.1 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.12",
"status": "affected",
"version": "Version 8.10.0.0: 8.10.0.12 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=10.6.0.0",
"status": "affected",
"version": "Version 10.6.0.0: 10.6.0.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=10.4.1.3",
"status": "affected",
"version": "Version 10.4.0.0: 10.4.1.3 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-08-06T19:24:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point."
}
],
"value": "Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T19:38:53.191Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04678",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-42398",
"datePublished": "2024-08-06T19:37:12.816Z",
"dateReserved": "2024-07-31T20:37:28.338Z",
"dateUpdated": "2025-03-24T21:04:59.030Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42393 (GCVE-0-2024-42393)
Vulnerability from cvelistv5 – Published: 2024-08-06 18:58 – Updated: 2024-08-12 16:00
VLAI
EPSS
VEX
Title
Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the Soft AP Daemon Service Accessed by the PAPI Protocol
Summary
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-06 19:13 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 |
Affected:
Version 8.12.0.0: 8.12.0.1 and below , ≤ <=8.12.0.1
(semver)
Affected: Version 8.10.0.0: 8.10.0.12 and below , ≤ <=8.10.0.12 (semver) |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , ≤ 8.10.0.12
(semver)
Affected: 8.12.0.0 , ≤ 8.12.0.1 (semver) cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:* |
Date Public
2024-08-06 19:18
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.10.0.12",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.12.0.1",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42393",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T19:13:40.644282Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-12T16:00:36.388Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=8.12.0.1",
"status": "affected",
"version": "Version 8.12.0.0: 8.12.0.1 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.12",
"status": "affected",
"version": "Version 8.10.0.0: 8.10.0.12 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-08-06T19:18:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.\u003c/p\u003e"
}
],
"value": "There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T19:44:56.016Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04678",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the Soft AP Daemon Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-42393",
"datePublished": "2024-08-06T18:58:52.509Z",
"dateReserved": "2024-07-31T20:37:28.337Z",
"dateUpdated": "2024-08-12T16:00:36.388Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42395 (GCVE-0-2024-42395)
Vulnerability from cvelistv5 – Published: 2024-08-06 18:56 – Updated: 2024-08-08 14:47
VLAI
EPSS
VEX
Title
Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the AP Certificate Management Service Accessed by the PAPI Protocol
Summary
There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-07 14:51 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 |
Affected:
Version 8.12.0.0: 8.12.0.1 and below , ≤ <=8.12.0.1
(semver)
Affected: Version 8.10.0.0: 8.10.0.12 and below , ≤ <=8.10.0.12 (semver) |
|
| arubanetworks | instant |
Affected:
8.12.0.0 , < 8.12.0.2
(semver)
cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:* |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , < 8.10.0.13
(semver)
cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:* |
Date Public
2024-08-06 19:16
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.12.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.12.0.2",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.10.0.13",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42395",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-07T14:51:10.591351Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-08T14:47:07.721Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=8.12.0.1",
"status": "affected",
"version": "Version 8.12.0.0: 8.12.0.1 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.12",
"status": "affected",
"version": "Version 8.10.0.0: 8.10.0.12 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-08-06T19:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.\u003c/p\u003e"
}
],
"value": "There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T19:42:44.319Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04678",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the AP Certificate Management Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-42395",
"datePublished": "2024-08-06T18:56:05.348Z",
"dateReserved": "2024-07-31T20:37:28.338Z",
"dateUpdated": "2024-08-08T14:47:07.721Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42396 (GCVE-0-2024-42396)
Vulnerability from cvelistv5 – Published: 2024-08-06 18:54 – Updated: 2025-03-25 16:46
VLAI
EPSS
VEX
Title
Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the AP Certificate Management Service Accessed by the PAPI Protocol
Summary
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-06 20:05 UTC
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 |
Affected:
Version 8.12.0.0: 8.12.0.1 and below , ≤ <=8.12.0.1
(semver)
Affected: Version 8.10.0.0: 8.10.0.12 and below , ≤ <=8.10.0.12 (semver) |
|
| arubanetworks | instant |
Affected:
8.10.0.0 , ≤ 8.10.0.12
(semver)
Affected: 8.12.0.0 , ≤ 8.12.0.1 (semver) cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:* |
Date Public
2024-08-06 19:16
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "instant",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "8.10.0.12",
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.12.0.1",
"status": "affected",
"version": "8.12.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42396",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T20:05:29.572011Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-25T16:46:21.354Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=8.12.0.1",
"status": "affected",
"version": "Version 8.12.0.0: 8.12.0.1 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.10.0.12",
"status": "affected",
"version": "Version 8.10.0.0: 8.10.0.12 and below",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)"
}
],
"datePublic": "2024-08-06T19:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMultiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point.\u003c/p\u003e"
}
],
"value": "Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected Access Point."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T19:41:51.479Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us\u0026docLocale=en_US"
}
],
"source": {
"advisory": "HPESBNW04678",
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the AP Certificate Management Service Accessed by the PAPI Protocol",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-42396",
"datePublished": "2024-08-06T18:54:42.859Z",
"dateReserved": "2024-07-31T20:37:28.338Z",
"dateUpdated": "2025-03-25T16:46:21.354Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}