Vulnerability · Published Sep 17, 2024 · Assigned by hpe
CVE-2024-42503Authenticated Remote Command Execution (RCE) Vulnerability in the Lua Package Within the AOS Command Line Interface (CLI)
High 7.2
In plain English
A high-severity OS command injection in Aruba OS from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.5%top 25.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Authenticated command execution vulnerability exist in the ArubaOS command line interface (CLI). Successful exploitation of this vulnerabilities result in the ability to run arbitrary commands as a priviledge user on the underlying operating system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hewlett Packard Enterprise (HPE) | Aruba OS | Version 10.6.0.0: 10.6.0.2 and below – through <=10.6.0.2Version 8.10.0.0: 8.10.0.13 and below – through <=8.10.0.13Version 10.5.0.0: 10.6.0.0 and below – through <=10.6.0.0Version 10.3.0.0: 10.4.0.0 and below – through <=10.4.0.0Version 8.11.0.0: 8.12.0.0 and below – through <=8.12.0.0Version 8.12.0.0: 8.12.0.1 and below – through <=8.12.0.1Version 6.5.4.0: 8.9.0.0 and below – through <=8.9.0.0 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H