CVE-2024-26304-RCE-exploit

CVE-2024-26304 - ArubaOS中的远程代码执行漏洞 概述 CVE-2024-26304 是一个影响 ArubaOS 的严重远程代码执行（RCE）漏洞，源于其 L2/L3 管理服务中的缓冲区溢出。攻击者可以通过向 PAPI （进程应用编程接口）UDP 端口 8211 发送特制数据包来利用此漏洞，从而以提升的权限执行任意代码。 CVSS 评分：9.8（严重） 攻击向量 ：网络 攻击复杂度 ：低 所需权限 ：无 用户交互 ：无 机密性影响 ：高 完整性影响 ：高 可用性影响 ：高 受影响产品 存在漏洞版本的 ArubaOS 系统 使用 PAPI UDP 端口 8211 的系统...

HPESBNW05134 rev.1 - Multiple Vulnerabilities in HPE Aruba Networking ArubaOS-CX (AOS-CX)

Potential Security Impact: Local: Access Restriction Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba CX 10000 Switch Series - Please refer to Vulnerability Summary for Impacted Versions Aruba CX 4100i Switch Series - Please refer to Vulnerability Summary for Impacted...

HPE-Aruba-AOS8-Vulnerabilities

⚠️ 披露状态： 本仓库中的所有发现已于 2026 年 5 月至 6 月期间 提交至 HPE Networking 漏洞赏金计划（Bugcrowd）。六份提交中有五份 在分类（triage）阶段被标记为“不适用（Not Applicable）”关闭， 且未对提交的证据进行技术性核对。 截至 2026 年 6 月，未发布任何修复。 完整报告来源 https://netacoding.com/posts/ghost-leak/ https://netacoding.com/posts/smurf-reflection/ https://netacoding.com/posts/xxe-ssrf...

HPESBNW05062 rev.1 - Status of OpenSSH Keystroke Obfuscation Bypass (CVE-2024-39894) on ArubaOS-CX

Potential Security Impact: Remote: Disclosure of Sensitive Information, Unauthorized Access to Sensitive Information, Unauthorized Privileged Access SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba CX 10000 Switch Series - Please refer to "Vulnerability Summary" section of th...

Hewlett Packard Enterprise ArubaOS 命令注入漏洞

Hewlett Packard Enterprise ArubaOS is a network wireless operating system developed by Hewlett Packard Enterprise. Hewlett Packard Enterprise ArubaOS has a command injection vulnerability, which stems from a flaw in the command-line interface. This vulnerability could allow authenticated remote...

Hewlett Packard Enterprise ArubaOS 操作系统命令注入漏洞

Hewlett Packard Enterprise ArubaOS is a network wireless operating system developed by Hewlett Packard Enterprise. Hewlett Packard Enterprise ArubaOS has a vulnerability related to operating system command injection. This vulnerability stems from a flaw in the command-line interface, which may...

Hewlett Packard Enterprise ArubaOS（HPE ArubaOS） 跨站脚本漏洞

Hewlett Packard Enterprise ArubaOS is a network wireless operating system developed by Hewlett Packard Enterprise. Hewlett Packard Enterprise ArubaOS contains a cross-site scripting vulnerability. This vulnerability stems from vulnerabilities in the web-based management interface, which may allow...

Hewlett Packard Enterprise ArubaOS 安全漏洞

Hewlett Packard Enterprise ArubaOS is a network wireless operating system developed by Hewlett Packard Enterprise. There is a security vulnerability in Hewlett Packard Enterprise ArubaOS, which stems from a flaw in the XML processing component. This vulnerability may allow unverified remote...

Vulnerabilities fixed in Aruba Networks ArubaOS

Aruba Networks has fixed vulnerabilities in AOS-8 and AOS-10. The vulnerabilities are in the Web management interfaces of the AOS-8 and AOS-10 systems. These vulnerabilities include arbitrarily file deletion, stack overflow, command injection, and improper input handling. A malicious party can...

CVE-2022-23682

Multiple vulnerabilities exist in the AOS-CX command line interface that could lead to authenticated command injection. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete switch compromise in ArubaOS-CX version...

CVE-2022-23684

A vulnerability in the web-based management interface of AOS-CX could allow a remote authenticated user with read-only privileges to escalate their permissions to those of an administrative user. Successful exploitation of this vulnerability allows an attacker to escalate privileges beyond their...

CVE-2022-23680

AOS-CX lacks Anti-CSRF protections in place for state-changing operations. This can potentially be exploited by an attacker to execute commands in the context of another user in ArubaOS-CX Switches versions: AOS-CX 10.10.xxxx: 10.10.0002 and below, AOS-CX 10.09.xxxx: 10.09.1020 and below, AOS-CX...

CVE-2022-23688

Multiple vulnerabilities exist in the processing of packet data by the LLDP service of AOS-CX. Successful exploitation of these vulnerabilities may allow an attacker to impact the availability of the AOS-CX LLDP service and/or the management plane of the switch in ArubaOS-CX Switches versions:...

CVE-2022-23679

AOS-CX lacks Anti-CSRF protections in place for state-changing operations. This can potentially be exploited by an attacker to execute commands in the context of another user in ArubaOS-CX Switches versions: AOS-CX 10.10.xxxx: 10.10.0002 and below, AOS-CX 10.09.xxxx: 10.09.1020 and below, AOS-CX...

CVE-2022-23676

A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices versions: ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch 16.03.xxxx: All versions; ArubaOS-Switch...

CVE-2022-23681

Multiple vulnerabilities exist in the AOS-CX command line interface that could lead to authenticated command injection. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete switch compromise in ArubaOS-CX version...

CVE-2022-23690

A vulnerability in the web-based management interface of AOS-CX could allow a remote unauthenticated attacker to fingerprint the exact version AOS-CX running on the switch. This allows an attacker to retrieve information which could be used to more precisely target the switch for further...

CVE-2022-23689

Multiple vulnerabilities exist in the processing of packet data by the LLDP service of AOS-CX. Successful exploitation of these vulnerabilities may allow an attacker to impact the availability of the AOS-CX LLDP service and/or the management plane of the switch in ArubaOS-CX Switches versions:...

CVE-2022-23683

Authenticated command injection vulnerabilities exist in the AOS-CX Network Analytics Engine via NAE scripts. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system, leading to a complete...

CVE-2022-37895

An unauthenticated Denial of Service DoS vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected AP of Aruba InstantOS 6.4.x:...