Low severity · published Jan 8, 2025
CVE-2024-54010
Unauthenticated Traffic Handling Flaw Allows Packet Leakage on HPE Aruba Networking CX 10000 series switches
3.4
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to conduct a packet forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leading to unauthorized data exposure.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AO
AOS-CX · Hewlett Packard Enterprise (HPE)
Version 10.10.0000: 10.10.1140 and below through <=10.10.1140; Version 10.13.0000: 10.13.1060 and below through <=10.13.1060; Version 10.14.0000: 10.14.1020 and below through <=10.14.1020; Version 10.15.0000: 10.15.0005 and below through <=10.15.0005 · source: vendor
AR
Arubaos-cx · Hpe
10.10.0000 before 10.13.1070; 10.14.0000 before 10.14.1030; 10.15.0000 before 10.15.1000 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-54010
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-54010
Broken Link
https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04772.txt
Vendor Advisory
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04772en_us&docLocale=en_US
More from AOS-CX
9.8
CVE-2026-73778
Credential Manager Vulnerability Allows Unauthorized Administrative Access
9.8
CVE-2026-73749
Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX
9.8
CVE-2026-23813
Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset
8.8
CVE-2026-73782
Unauthenticated Format String Vulnerability leads to Remote Code Execution in AOS-CX
8.8
CVE-2026-73763
Unauthenticated Remote Command Execution in Management Component
