Skip to main content

HPE Aruba Networking Releases Security Updates for Instant AOS-8 and AOS-10 in Access Points

Three critical vulnerabilities could lead to arbitrary code execution in multiple series of Aruba Access Points

Threat ID:
CC-4553
Threat Severity:
Medium
Published:
26 September 2024 4:40 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Three critical vulnerabilities could lead to arbitrary code execution in multiple series of Aruba Access Points

Threat details

End of maintenance ArubaOS software versions are also affected

The following software versions that are End of Support Life (EoSL) are affected by these vulnerabilities and are not addressed by this advisory:

  • AOS-10.5.x.x: all
  • AOS-10.3.x.x: all
  • Instant AOS-8.11.x.x: all
  • Instant AOS-8.9.x.x: all
  • Instant AOS-8.8.x.x: all
  • Instant AOS-8.7.x.x: all
  • Instant AOS-8.6.x.x: all
  • Instant AOS-8.5.x.x: all
  • Instant AOS-8.4.x.x: all
  • Instant AOS-6.5.x.x: all
  • Instant AOS-6.4.x.x: all

HPE Aruba Networking strongly recommends all customers running End of Support Life (EoSL) software to upgrade to a supported version as soon as possible.

Introduction

Hewlett Packard Enterprise (HPE) Aruba Networking has issued an advisory that addresses 3 vulnerabilities that affect Aruba Access Points (APs) product lines that use Instant AOS (ArubaOS). AOS is a distributed network operating system working with Aruba Central that controls APs and optional gateways.

Three critical command injection vulnerabilities that have CVSSv3 scores of 9.8 could be exploited by an unauthenticated, remote attacker via a specially crafted packet to achieve remote code execution (RCE). Successful exploitation could lead to the ability to execute arbitrary code as a privileged user on the underlying operating system.

Access Points are popular targets for attackers

Some access points and gateways are internet-facing by design and present an attractive target to facilitate initial access to an organisation's network, with exploitation by cyber threat groups often reported soon after official disclosure. The NHS England National CSOC assesses exploitation as highly likely, should a proof-of-concept (PoC) exploit be publicly released.

Remediation advice

Affected organisations are encouraged to review the HPE Security Advisory HPESBNW04712 rev.1 - HPE Aruba Networking Access Points Multiple Vulnerabilities and apply any relevant updates or workarounds.

Last edited: 26 September 2024 4:40 pm