Detections
Analytics
ArubaOS 8.10.x < 8.10.0.14, 8.12.x < 8.12.0.2, 10.6.x < 10.6.0.3 Multiple Vulnerabilities (HPESBNW04709)
high Nessus Plugin ID 207739
Language:
Synopsis
An application installed on the remote host is affected by multiple vulnerabilities.Description
The version of ArubaOS installed on the remote host is affected by multiple vulnerabilities:- An authenticated Path Traversal vulnerabilities exists in the ArubaOS. Successful exploitation of this vulnerability allows an attacker to install unsigned packages on the underlying operating system, enabling the threat actor to execute arbitrary code or install implants. (CVE-2024-42501)
- Authenticated command injection vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability result in the ability to inject shell commands on the underlying operating system. (CVE-2024-42502)
- Authenticated command execution vulnerability exist in the ArubaOS command line interface (CLI). Successful exploitation of this vulnerabilities result in the ability to run arbitrary commands as a priviledge user on the underlying operating system. (CVE-2024-42503)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to the ArubaOS version mentioned in the vendor advisory.See Also
Plugin Details
Severity: High
ID: 207739
File Name: arubaos-aruba-HPESBNW04709.nasl
Version: 1.2
Type: combined
Family: Misc.
Published: 9/25/2024
Updated: 9/26/2024
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.4
CVSS v2
Risk Factor: High
Base Score: 8.3
Temporal Score: 6.1
Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C
CVSS Score Source: CVE-2024-42501
CVSS v3
Risk Factor: High
Base Score: 7.2
Temporal Score: 6.3
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2024-42503
Vulnerability Information
CPE: cpe:/o:arubanetworks:arubaos, cpe:/o:hp:arubaos
Required KB Items: installed_sw/ArubaOS
Exploit Ease: No known exploits are available
Patch Publication Date: 9/17/2024
Vulnerability Publication Date: 9/17/2024