4 Important Vulnerabilities Expose HPE Aruba Gadgets to RCE Assaults

Might 03, 2024NewsroomVulnerability / Software program Safety

HPE Aruba Networking (previously Aruba Networks) has launched safety updates to handle important flaws impacting ArubaOS that would lead to distant code execution (RCE) on affected programs.

Of the 10 safety defects, 4 are rated important in severity –

  • CVE-2024-26304 (CVSS rating: 9.8) – Unauthenticated Buffer Overflow Vulnerability within the L2/L3 Administration Service Accessed by way of the PAPI Protocol
  • CVE-2024-26305 (CVSS rating: 9.8) – Unauthenticated Buffer Overflow Vulnerability within the Utility Daemon Accessed by way of the PAPI Protocol
  • CVE-2024-33511 (CVSS rating: 9.8) – Unauthenticated Buffer Overflow Vulnerability within the Automated Reporting Service Accessed by way of the PAPI Protocol
  • CVE-2024-33512 (CVSS rating: 9.8) – Unauthenticated Buffer Overflow Vulnerability within the Native Consumer Authentication Database Accessed by way of the PAPI Protocol

A risk actor might exploit the aforementioned buffer overflow bugs by sending specifically crafted packets destined to the Course of Utility Programming Interface (PAPI) UDP port (8211), thereby gaining the power to execute arbitrary code as a privileged consumer on the underlying working system.

Cybersecurity

The vulnerabilities, which affect Mobility Conductor (previously Mobility Grasp), Mobility Controllers, and WLAN Gateways and SD-WAN Gateways managed by Aruba Central, are current within the following software program variations –

  • ArubaOS 10.5.1.0 and under
  • ArubaOS 10.4.1.0 and under
  • ArubaOS 8.11.2.1 and under, and
  • ArubaOS 8.10.0.10 and under

Additionally they affect the ArubaOS and SD-WAN software program variations which have reached finish of upkeep standing –

  • ArubaOS 10.3.x.x
  • ArubaOS 8.9.x.x
  • ArubaOS 8.8.x.x
  • ArubaOS 8.7.x.x
  • ArubaOS 8.6.x.x
  • ArubaOS 6.5.4.x
  • SD-WAN 8.7.0.0-2.3.0.x, and
  • SD-WAN 8.6.0.4-2.2.x.x

A safety researcher named Chancen has been credited with discovering and reporting seven of the ten points, together with the 4 important buffer overflow vulnerabilities.

Customers are suggested to use the most recent fixes to mitigate potential threats. As short-term workarounds for ArubaOS 8.x, the corporate is recommending that customers allow the Enhanced PAPI Safety characteristic utilizing a non-default key.

Discovered this text fascinating? Observe us on Twitter and LinkedIn to learn extra unique content material we put up.

Recent articles

Researchers uncover first UEFI bootkit malware for Linux

The primary UEFI bootkit particularly focusing...

Russian Hackers Exploit Firefox and Home windows 0-Days to Deploy Backdoor

SUMMARY RomCom Exploits Double Zero-Day: RomCom, a Russia-linked group used beforehand...

PureVPN Overview (2024): Is PureVPN Secure to Use?

PureVPN quick infoOur ranking: 3.7 stars out of 5Pricing:...

Important Flaw in ProjectSend Below Lively Exploitation Towards Public-Going through Servers

Nov 27, 2024Ravie LakshmananVulnerability / Software program Safety A vital...