Released Updates
Hewlett Packard Enterprise (HPE) has released updates for its Instant AOS-8 and AOS-10 software to fix two critical security vulnerabilities affecting Aruba Networking Access Points.
The vulnerabilities could allow remote attackers to execute unauthenticated command injection by sending specially crafted packets to Aruba's Access Point management protocol (PAPI) via UDP port 8211.
The flaws, identified as CVE-2024-42509 and CVE-2024-47460, are rated with severity scores of 9.8 and 9.0, respectively, and impact the command line interface (CLI) service accessed through the PAPI protocol.
Additionally, the update addresses four other security issues:
- CVE-2024-47461 (severity score 7.2): Enables authenticated remote command execution, allowing attackers to run arbitrary commands on the underlying OS.
- CVE-2024-47462 and CVE-2024-47463 (severity score 7.2): Allow authenticated attackers to create arbitrary files, which could potentially lead to remote command execution.
- CVE-2024-47464 (severity score 6.8): Allows an authenticated attacker to access unauthorized files via path traversal.
These vulnerabilities affect AOS-10.4.x.x (version 10.4.1.4 and older), Instant AOS-8.12.x.x (version 8.12.0.2 and earlier), and Instant AOS-8.10.x.x (version 8.10.0.13 and previous versions).
HPE’s advisory also mentions that older software versions that have reached their End of Maintenance date are affected, but will not receive security updates.
Recommended Updates and Workarounds
To mitigate these vulnerabilities, HPE advises users to upgrade to the following versions or later:
-
AOS-10.7.x.x: Update to version 10.7.0.0 or newer.
-
AOS-10.4.x.x: Update to version 10.4.1.5 or later.
-
Instant AOS-8.12.x.x: Update to version 8.12.0.3 or above.
-
Instant AOS-8.10.x.x: Update to version 8.10.0.14 or newer.
For situations where immediate updates aren’t possible, HPE has suggested the following workarounds:
For critical vulnerabilities: Restrict or block UDP port 8211 from any untrusted networks.
For other vulnerabilities: Limit access to the CLI and web-based management interfaces by isolating them on a dedicated layer 2 segment or VLAN, and manage access with layer 3 or higher firewall policies to reduce exposure.
No instances of active exploitation have been reported, but HPE strongly recommends applying these updates or mitigations to secure systems.
