Vulnerability · Published Sep 17, 2024 · Assigned by hpe
CVE-2024-42501Authenticated Path Traversal Vulnerability Leads to a Remote Command Execution (RCE)
High 7.2
In plain English
A high-severity path traversal in Aruba OS from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.2%top 32.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An authenticated Path Traversal vulnerabilities exists in the ArubaOS. Successful exploitation of this vulnerability allows an attacker to install unsigned packages on the underlying operating system, enabling the threat actor to execute arbitrary code or install implants.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hewlett Packard Enterprise (HPE) | Aruba OS | Version 10.6.0.0: 10.6.0.2 and below – through <=10.6.0.2Version 8.10.0.0: 8.10.0.13 and below – through <=8.10.0.13Version 10.5.0.0: 10.6.0.0 and below – through <=10.6.0.0Version 10.3.0.0: 10.4.0.0 and below – through <=10.4.0.0Version 8.11.0.0: 8.12.0.0 and below – through <=8.12.0.0Version 8.12.0.0: 8.12.0.1 and below – through <=8.12.0.1Version 6.5.4.0: 8.9.0.0 and below – through <=8.9.0.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H