CVE-2024-42506: fallo crítico en Hewlett Packard Enterprise (HPE) Aruba OS
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 1.4%
Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Hewlett Packard Enterprise (HPE) · Aruba OSCVEs relacionadas — Hewlett Packard Enterprise (HPE) Aruba OS
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-42502HIGHAuthenticated Remote Command Execution (RCE) Vulnerability in the AOS Command Line InterfaceEPSS 1.8%CVE-2024-42503HIGHAuthenticated Remote Command Execution (RCE) Vulnerability in the Lua Package Within the AOS Command Line Interface (CLI)EPSS 1.5%CVE-2024-42505CRITICALUnauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI ProtocolEPSS 1.5%CVE-2024-42507CRITICALUnauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI ProtocolEPSS 1.4%CVE-2024-42501HIGHAuthenticated Path Traversal Vulnerability Leads to a Remote Command Execution (RCE)EPSS 1.2%