CVE-2024-26305Critical· 9.8▾ MidnightThere is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP p…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
15%
There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
sd-wan = 8.6.0.4-2.2.0.0sd-wan = 8.6.0.4-2.2.0.7sd-wan = 8.7.0.0-2.3.0.0sd-wan = 8.7.0.0-2.3.0.9arubaos >= 6.5.4.0, < 8.10.0.12arubaos >= 8.11.0.0, < 8.11.2.2arubaos >= 10.4.0.0, < 10.4.1.1arubaos >= 10.5.0.0, < 10.5.1.1Upgrade past the affected range:
arubaos 10.5.1.1Connected by shared product, vendor, weakness, or advisory.
CVE-2022-37905Medium· 6.6Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence
CVE-2022-37902High· 7.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
CVE-2022-37903High· 7.2A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface
CVE-2022-37904Medium· 6.6Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence
CVE-2022-37899High· 7.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
CVE-2022-37900High· 7.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface