High severity · published Sep 17, 2024
CVE-2024-42501
Authenticated Path Traversal Vulnerability Leads to a Remote Command Execution (RCE)
7.2
CVSS
1.2%
EPSS
No
On KEV
Description
An authenticated Path Traversal vulnerabilities exists in the ArubaOS. Successful exploitation of this vulnerability allows an attacker to install unsigned packages on the underlying operating system, enabling the threat actor to execute arbitrary code or install implants.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AO
Aruba OS · Hewlett Packard Enterprise (HPE)
Version 10.6.0.0: 10.6.0.2 and below through <=10.6.0.2; Version 8.10.0.0: 8.10.0.13 and below through <=8.10.0.13; Version 10.5.0.0: 10.6.0.0 and below through <=10.6.0.0; Version 10.3.0.0: 10.4.0.0 and below through <=10.4.0.0; Version 8.11.0.0: 8.12.0.0 and below through <=8.12.0.0; Version 8.12.0.0: 8.12.0.1 and below through <=8.12.0.1; +1 more · source: vendor
AR
Arubaos · Arubanetworks
10.6.0.0 through 10.6.0.2; 8.10.0.0 through 8.10.0.13; 10.5.0.0 through 10.6.0.0; 10.3.0.0 through 10.4.0.0; 8.11.0.0 through 8.12.0.0; 8.12.0.0 through 8.12.0.1; +1 more · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-42501
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-42501
support.hpe.com
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04709en_us&docLocale=en_US
More from Aruba OS
9.8
CVE-2024-42507
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
9.8
CVE-2024-42506
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
9.8
CVE-2024-42505
Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol
7.2
CVE-2024-42503
Authenticated Remote Command Execution (RCE) Vulnerability in the Lua Package Within the AOS Command Line Interface (CLI)
7.2
CVE-2024-42502
Authenticated Remote Command Execution (RCE) Vulnerability in the AOS Command Line Interface