Vulnerability · Published Jan 7, 2025 · Assigned by hpe
CVE-2024-54006Authenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client Bridge
High 7.2
In plain English
A high-severity command injection in HPE Aruba Networking 501 Wireless Client Bridge from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Official description
Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute arbitrary commands as a privileged user on the underlying operating system. Exploitation requires administrative authentication credentials on the host system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking 501 Wireless Client Bridge | V2.0.0.0 – through V2.1.1.0-B0030 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H