CVE-2024-47460 | THREATINT

Description

Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

Reserved 2024-09-24 | Published 2024-11-05 | Updated 2024-11-09 | Assigner hpe

CRITICAL: 9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Product status

Default status

affected

AOS-10.4.x.x: 10.4.1.4 and below

affected

Instant AOS-8.12.x.x: 8.12.0.2 and below

affected

Instant AOS-8.10.x.x: 8.10.0.13 and below

affected

Credits

Erik De Jong (bugcrowd.com/erikdejong) reporter

References

support.hpe.com/...y?docId=hpesbnw04722en_us&docLocale=en_US

cve.org (CVE-2024-47460)

nvd.nist.gov (CVE-2024-47460)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.