CVE-2024-42502
Authenticated Remote Command Execution (RCE) Vulnerability in the AOS Command Line Interface
Severity Score
7.2
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
Authenticated command injection vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability result in the ability to inject shell commands on the underlying operating system.
*Credits:
erikdejong
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-08-02 CVE Reserved
- 2024-09-17 CVE Published
- 2024-09-18 CVE Updated
- 2024-09-18 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04709en_us&docLocale=en_US |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Hewlett Packard Enterprise (HPE) Search vendor "Hewlett Packard Enterprise (HPE)" | Aruba OS Search vendor "Hewlett Packard Enterprise (HPE)" for product "Aruba OS" | <= 10.6.0.2 Search vendor "Hewlett Packard Enterprise (HPE)" for product "Aruba OS" and version " <= 10.6.0.2" | en |
Affected
| ||||||
| Hewlett Packard Enterprise (HPE) Search vendor "Hewlett Packard Enterprise (HPE)" | Aruba OS Search vendor "Hewlett Packard Enterprise (HPE)" for product "Aruba OS" | <= 8.10.0.13 Search vendor "Hewlett Packard Enterprise (HPE)" for product "Aruba OS" and version " <= 8.10.0.13" | en |
Affected
| ||||||
| Hewlett Packard Enterprise (HPE) Search vendor "Hewlett Packard Enterprise (HPE)" | Aruba OS Search vendor "Hewlett Packard Enterprise (HPE)" for product "Aruba OS" | <= 10.6.0.0 Search vendor "Hewlett Packard Enterprise (HPE)" for product "Aruba OS" and version " <= 10.6.0.0" | en |
Affected
| ||||||
| Hewlett Packard Enterprise (HPE) Search vendor "Hewlett Packard Enterprise (HPE)" | Aruba OS Search vendor "Hewlett Packard Enterprise (HPE)" for product "Aruba OS" | <= 10.4.0.0 Search vendor "Hewlett Packard Enterprise (HPE)" for product "Aruba OS" and version " <= 10.4.0.0" | en |
Affected
| ||||||
| Hewlett Packard Enterprise (HPE) Search vendor "Hewlett Packard Enterprise (HPE)" | Aruba OS Search vendor "Hewlett Packard Enterprise (HPE)" for product "Aruba OS" | <= 8.12.0.0 Search vendor "Hewlett Packard Enterprise (HPE)" for product "Aruba OS" and version " <= 8.12.0.0" | en |
Affected
| ||||||
| Hewlett Packard Enterprise (HPE) Search vendor "Hewlett Packard Enterprise (HPE)" | Aruba OS Search vendor "Hewlett Packard Enterprise (HPE)" for product "Aruba OS" | <= 8.12.0.1 Search vendor "Hewlett Packard Enterprise (HPE)" for product "Aruba OS" and version " <= 8.12.0.1" | en |
Affected
| ||||||
| Hewlett Packard Enterprise (HPE) Search vendor "Hewlett Packard Enterprise (HPE)" | Aruba OS Search vendor "Hewlett Packard Enterprise (HPE)" for product "Aruba OS" | <= 8.9.0.0 Search vendor "Hewlett Packard Enterprise (HPE)" for product "Aruba OS" and version " <= 8.9.0.0" | en |
Affected
| ||||||