HPE Aruba Networking has fastened three vital vulnerabilities within the Command Line Interface (CLI) service of its Aruba Entry Factors, which may let unauthenticated attackers achieve distant code execution on susceptible units.
The vulnerabilities (CVE-2024-42505, CVE-2024-42506, and CVE-2024-42507) will be exploited by sending specifically crafted packets to the PAPI (Aruba’s Entry Level administration protocol) UDP port (8211) to get privileged entry to execute arbitrary code on susceptible units.
The Hewlett Packard Enterprise (HPE) subsidiary (previously generally known as Aruba Networks) confirmed in a safety advisory launched earlier this week that the safety flaws affect Aruba Entry Factors operating Prompt AOS-8 and AOS-10.
The vulnerabilities had been reported by safety researcher Erik De Jong via the corporate’s bug bounty program, and impacted software program variations embrace:
- AOS-10.6.x.x: 10.6.0.2 and beneath
- AOS-10.4.x.x: 10.4.1.3 and beneath
- Prompt AOS-8.12.x.x: 8.12.0.1 and beneath
- Prompt AOS-8.10.x.x: 8.10.0.13 and beneath
The corporate urged directors to put in the newest safety updates (accessible from the HPE Networking Assist Portal) on susceptible entry factors to forestall potential assaults.
Workaround accessible, no lively exploitation
As a brief workaround for units operating Prompt AOS-8.x code, admins can allow “cluster-security” to dam exploitation makes an attempt. For AOS-10 units, the corporate advises blocking entry to port UDP/8211 from all untrusted networks.
HPE Aruba Networking additionally confirmed that different Aruba merchandise, together with Networking Mobility Conductors, Mobility Controllers, and SD-WAN Gateways, usually are not impacted.
In response to the HPE Product Safety Response Crew, no public exploit code is on the market, and there have been no reviews of assaults concentrating on the three vital vulnerabilities.
Earlier this 12 months, the corporate additionally patched 4 vital RCE vulnerabilities impacting a number of variations of ArubaOS, its proprietary community working system.
In February, Hewlett Packard Enterprise (HPE) stated it was investigating a possible breach after a risk actor posted credentials and different delicate info (allegedly stolen from HPE) on the market on a hacking discussion board.
Two weeks earlier, it reported that its Microsoft Workplace 365 e-mail surroundings was breached in Might 2023 by hackers believed to be a part of the APT29 risk group linked to Russia’s Overseas Intelligence Service (SVR).
