CVE-2024-42505

CRITICAL

Aruba OS <= 10.6.0.2, <= 10.4.1.13, <= 8.10.0.13, <= 8.12.0.1 - Unauthenticated Remote Code Execution via PAPI UDP Port

Title source: llm

Description

Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

References (1)

Core 1

Core References

Vendor Advisory

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04712en_us&docLocale=en_US

Scores

CVSS v3 9.8

EPSS 0.0150

EPSS Percentile 70.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-77

Status published

Products (4)

Hewlett Packard Enterprise (HPE)/Aruba OS Version 10.0.0.0: 10.4.1.13 and below - <=10.4.1.13

Hewlett Packard Enterprise (HPE)/Aruba OS Version 10.5.0.0: 10.6.0.2 and below - <=10.6.0.2

Hewlett Packard Enterprise (HPE)/Aruba OS Version 6.4.0.0: 8.10.0.13 and below - <=8.10.0.13

Hewlett Packard Enterprise (HPE)/Aruba OS Version 8.11.0.0: 8.12.0.1 and below - <=8.12.0.1

Published Sep 25, 2024

Tracked Since Feb 18, 2026