CVE-2024-31470 | THREATINT

Assigner	hpe
Reserved	2024-04-03
Published	2024-05-14
Updated	2024-08-02

Description

There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CRITICAL: 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Product status

Default status

affected

InstantOS or ArubaOS (access points) 10.5.x.x: 10.5.1.0 and below.

affected

InstantOS or ArubaOS (access points) 10.4.x.x: 10.4.1.0 and below.

affected

InstantOS or ArubaOS (access points) 8.11.x.x: 8.11.2.1 and below.

affected

InstantOS or ArubaOS (access points) 8.10.x.x: 8.10.0.10 and below.

affected

InstantOS or ArubaOS (access points) 8.6.x.x: 8.6.0.23 and below.

affected

Credits

Chancen 0x4005c84a40

References

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt

cve.org CVE-2024-31470

nvd.nist.gov CVE-2024-31470

Download JSON