// For flags

CVE-2024-47463

Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE)

Severity Score

7.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnerability could allow an authenticated remote attacker to create arbitrary files, which could lead to a remote command execution (RCE) on the underlying operating system.

Existe una vulnerabilidad de creación de archivos arbitrarios en la interfaz de línea de comandos de Instant AOS-8 y AOS-10. La explotación exitosa de esta vulnerabilidad podría permitir que un atacante remoto autenticado cree archivos arbitrarios, lo que podría provocar una ejecución remota de comandos (RCE) en el sistema operativo subyacente.

*Credits: zzcentury from Ubisectech Sirius Team (https://www.ubisectech.com/)
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-09-24 CVE Reserved
  • 2024-11-05 CVE Published
  • 2024-11-06 EPSS Updated
  • 2024-11-09 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Hewlett Packard Enterprise (HPE)
Search vendor "Hewlett Packard Enterprise (HPE)"
HPE Aruba Networking Access Points, Instant AOS-8, And AOS-10
Search vendor "Hewlett Packard Enterprise (HPE)" for product "HPE Aruba Networking Access Points, Instant AOS-8, And AOS-10"
<= 10.4.1.4
Search vendor "Hewlett Packard Enterprise (HPE)" for product "HPE Aruba Networking Access Points, Instant AOS-8, And AOS-10" and version " <= 10.4.1.4"
en
Affected
Hewlett Packard Enterprise (HPE)
Search vendor "Hewlett Packard Enterprise (HPE)"
HPE Aruba Networking Access Points, Instant AOS-8, And AOS-10
Search vendor "Hewlett Packard Enterprise (HPE)" for product "HPE Aruba Networking Access Points, Instant AOS-8, And AOS-10"
<= 8.12.0.2
Search vendor "Hewlett Packard Enterprise (HPE)" for product "HPE Aruba Networking Access Points, Instant AOS-8, And AOS-10" and version " <= 8.12.0.2"
en
Affected
Hewlett Packard Enterprise (HPE)
Search vendor "Hewlett Packard Enterprise (HPE)"
HPE Aruba Networking Access Points, Instant AOS-8, And AOS-10
Search vendor "Hewlett Packard Enterprise (HPE)" for product "HPE Aruba Networking Access Points, Instant AOS-8, And AOS-10"
<= 8.10.0.13
Search vendor "Hewlett Packard Enterprise (HPE)" for product "HPE Aruba Networking Access Points, Instant AOS-8, And AOS-10" and version " <= 8.10.0.13"
en
Affected