nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-47461 CVE-2024-47461
HIGH
Authenticated Arbitrary Remote Command Execution (RCE) in Instant AOS-8 and AOS-10
Record summary
CVE-2024-47461 has a selected CVSS score of 7.2 (high).
Description
An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying host operating system.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 8, 2024 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10Browse Hewlett Packard Enterprise (HPE) / HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10Default status: affected | CVE List | AOS-10.4.x.x: 10.4.1.4 and below to ≤ <=10.4.1.4 | affected |
| Instant AOS-8.12.x.x: 8.12.0.2 and below to ≤ <=8.12.0.2 | affected | ||
| Instant AOS-8.10.x.x: 8.10.0.13 and below to ≤ <=8.10.0.13 | affected | ||
Default status: affected | CVE List | 10.4.0.0 to ≤ 10.4.1.4 | affected |
| 10.3.0.0 to < 10.4.0.0 | affected | ||
| 10.5.0.0 to < 10.7.0.0 | affected | ||
Default status: affected | CVE List | 8.12.0.0 to ≤ 8.12.0.2 | affected |
| 8.10.0.0 to ≤ 8.10.0.13 | affected | ||
| 6.4.0.0 to < 6.6.0.0 | affected | ||
| 8.4.0.0 to < 8.10.0.0 | affected | ||
| 8.11.0.0 to < 8.12.0.0 | affected |
References
2support.hpe.com
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us&docLocale=en_US