Log in Start free

Vulnerability · Published Mar 5, 2024 · Assigned by hpe

CVE-2024-25614

Medium 5.5

In plain English

A medium-severity path traversal in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.5%top 56.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

There is an arbitrary file deletion vulnerability in the CLI used by ArubaOS. Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to denial-of-service conditions and impact the integrity of the controller.

Affected products (as reported)

VendorProductVersions
Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers and Campus/Remote Access Points ArubaOS 10.5.x.x: 10.5.0.1 and belowArubaOS 10.4.x.x: 10.4.0.3 and belowArubaOS 8.11.x.x: 8.11.2.0 and belowArubaOS 8.10.x.x: 8.10.0.9 and below

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

References