HPE Aruba Networking fixes multiple critical flaws in their Access Points with AOS-8 and AOS-10 software
Take action: A bunch of flaws impacting HPE Aruba Access Points. If you are running those Access Points, start reviewing versions and patching. It's going to be a longer effort since these systems are usually part of a large implementation.
Learn More
HPE Aruba Networking has issued an advisory regarding multiple critical vulnerabilities affecting its Access Points operating on Instant AOS-8 and AOS-10 software versions.
These vulnerabilities, allow for remote, unauthenticated command execution by leveraging the PAPI (Aruba’s Access Point management protocol) on UDP port 8211. Affected users should apply the recommended firmware updates immediately to mitigate risks of unauthorized system compromise.
-
CVE-2024-42509 (CVSS score 9.8) - Unauthenticated Command Injection via PAPI Protocol - Enables unauthenticated attackers to execute arbitrary code as a privileged user by sending crafted packets to UDP port 8211, leading to full system compromise.
- Mitigation: For Instant AOS-8, enabling "cluster-security" prevents exploitation. AOS-10 users should block UDP/8211 access from untrusted networks.
-
CVE-2024-47460 (CVSS score 9.0) - Unauthenticated Command Injection via PAPI Protocol - Similar to CVE-2024-42509, this vulnerability also allows unauthenticated code execution on the CLI service, potentially compromising the operating system.
- Mitigation: Same as CVE-2024-42509, restricting port access or enabling "cluster-security" in AOS-8.
-
CVE-2024-47461 (CVSS score 7.2) - Authenticated Command Injection in CLI - Allows authenticated users to execute arbitrary commands on the operating system, which can lead to a complete system compromise.
- Mitigation: Limit CLI and management interfaces to isolated VLANs or secure with firewall policies.
-
CVE-2024-47462 and CVE-2024-47463 (CVSS score 7.2) - Authenticated Arbitrary File Creation - Permits authenticated users to create arbitrary files, which could then lead to remote code execution.
-
Mitigation: Restrict management interfaces to specific VLANs or secure with firewall rules.
-
- CVE-2024-47464 (CVSS score 6.8) - Authenticated Path Traversal - Allows authenticated users to access unauthorized files by copying them to a readable location on the device.
-
Mitigation: Use network segmentation and firewall policies to limit management interface access.
-
Affected versions are:
- Critical and High-Risk Versions: AOS-10.4.x.x (10.4.1.4 and below), Instant AOS-8.12.x.x (8.12.0.2 and below), and Instant AOS-8.10.x.x (8.10.0.13 and below).
- End-of-Maintenance (EoM): Versions including AOS-10.6.x.x, AOS-10.5.x.x, and Instant AOS-8.11.x.x and older versions remain vulnerable without available patches.
To address these vulnerabilities, HPE Aruba Networking recommends upgrading to:
- AOS-10.7.x.x: Version 10.7.0.0 and newer
- AOS-10.4.x.x: Version 10.4.1.5 and newer
- Instant AOS-8.12.x.x: Version 8.12.0.3 and newer
- Instant AOS-8.10.x.x: Version 8.10.0.14 and newer
