Lucene search

K
cve[email protected]CVE-2024-31470
HistoryMay 14, 2024 - 11:15 p.m.

CVE-2024-31470

2024-05-1423:15:09
web.nvd.nist.gov
3
buffer overflow
sae service
remote code execution
papi udp port
privileged user
vulnerability

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba’s Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Aruba InstantOS and Aruba Access Points running ArubaOS 10",
    "vendor": "Hewlett Packard Enterprise (HPE)",
    "versions": [
      {
        "status": "affected",
        "version": "InstantOS or ArubaOS (access points) 10.5.x.x: 10.5.1.0 and below."
      },
      {
        "status": "affected",
        "version": "InstantOS or ArubaOS (access points) 10.4.x.x: 10.4.1.0 and below."
      },
      {
        "status": "affected",
        "version": "InstantOS or ArubaOS (access points) 8.11.x.x: 8.11.2.1 and below."
      },
      {
        "status": "affected",
        "version": "InstantOS or ArubaOS (access points) 8.10.x.x: 8.10.0.10 and below."
      },
      {
        "status": "affected",
        "version": "InstantOS or ArubaOS (access points) 8.6.x.x: 8.6.0.23 and below."
      }
    ]
  }
]

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

Related for CVE-2024-31470