High severity · published Jan 7, 2025
CVE-2024-54007
Authenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client Bridge
7.2
CVSS
1.5%
EPSS
No
On KEV
Description
Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute arbitrary commands as a privileged user on the underlying operating system. Exploitation requires administrative authentication credentials on the host system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
Affected product
HA
HPE Aruba Networking 501 Wireless Client Bridge
Hewlett Packard Enterprise (HPE)
More from HPE Aruba Networking 501 Wireless Client Bridge
7.2
CVE-2024-54006
Authenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client Bridge