arubanetworks Vulnerabilities and Affected Products
Vulnerabilities associated with edgeconnect_sd-wan_orchestrator.
Products
Clear product- arubaos50 vulnerabilities
- instant29 vulnerabilities
- sd-wan15 vulnerabilities
- clearpass_policy_manager8 vulnerabilities
- edgeconnect_sd-wan_orchestrator8 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-41136MEDIUM | Authenticated Command Injection in HPE Aruba Networking EdgeConnect SD-WAN Command Line InterfaceAn authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. | CVSS6.8v3.1 | EPSS0.911% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-41135HIGH | Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line InterfaceA vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise CWE-77Jul 24, 2024 | CVSS7.2v3.1 | EPSS0.754% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-41134HIGH | Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line InterfaceA vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise CWE-77Jul 24, 2024 | CVSS7.2v3.1 | EPSS0.682% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-41133HIGH | Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line InterfaceA vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise CWE-77Jul 24, 2024 | CVSS7.2v3.1 | EPSS0.754% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-33519HIGH | Authenticated Server-Side prototype pollution Leading to Information DisclosureA vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise. CWE-1321Jul 24, 2024 | CVSS7.2v3.1 | EPSS0.702% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-22444MEDIUM | A vulnerability within the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victims browser in the context of the affected interface. CWE-79Jul 24, 2024 | CVSS6.1v3.1 | EPSS0.302% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-22443HIGH | A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise. CWE-1321Jul 24, 2024 | CVSS7.2v3.1 | EPSS0.778% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-41914HIGH | A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. CWE-79Jul 24, 2024 | CVSS8.1v3.1 | EPSS0.543% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |