Hewlett Packard Enterprise (HPE) has launched safety updates to handle a number of vulnerabilities impacting Aruba Networking Entry Level merchandise, together with two essential bugs that might lead to unauthenticated command execution.
The issues have an effect on Entry Factors working Immediate AOS-8 and AOS-10 –
- AOS-10.4.x.x: 10.4.1.4 and beneath
- Immediate AOS-8.12.x.x: 8.12.0.2 and beneath
- Immediate AOS-8.10.x.x: 8.10.0.13 and beneath
Essentially the most extreme among the many six newly patched vulnerabilities are CVE-2024-42509 (CVSS rating: 9.8) and CVE-2024-47460 (CVSS rating: 9.0), two essential unauthenticated command injection flaws within the CLI Service that might outcome within the execution of arbitrary code.
“Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba’s Access Point management protocol) UDP port (8211),” HPE mentioned in an advisory for each the failings.
“Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.”
It is suggested to allow cluster safety by way of the cluster-security command to mitigate CVE-2024-42509 and CVE-2024-47460 on gadgets working Immediate AOS-8 code. Nevertheless, for AOS-10 gadgets, the corporate recommends blocking entry to UDP port 8211 from all untrusted networks.
Additionally resolved by HPE are 4 different vulnerabilities –
- CVE-2024-47461 (CVSS rating: 7.2) – An authenticated arbitrary distant command execution (RCE) in Immediate AOS-8 and AOS-10
- CVE-2024-47462 and CVE-2024-47463 (CVSS scores: 7.2) – An arbitrary file creation vulnerability in Immediate AOS-8 and AOS-10 that results in authenticated distant command execution
- CVE-2024-47464 (CVSS rating: 6.8) – An authenticated path traversal vulnerability results in distant unauthorized entry to recordsdata
As workarounds, customers are being urged to limit entry to CLI and web-based administration interfaces by putting them inside a devoted VLAN, and controlling them by way of firewall insurance policies at layer 3 and above.
“Although Aruba Network access points have not previously been reported as exploited in the wild, they are an attractive target for threat actors due to the potential access these vulnerabilities could provide through privileged user RCE,” Arctic Wolf mentioned. “Additionally, threat actors may attempt to reverse-engineer the patches to exploit unpatched systems in the near future.”
