PT-2024-3205 · Aruba · Arubaos

Chancen

·

Published

2024-04-30

·

Updated

2024-10-12

·

CVE-2024-26304

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions ArubaOS versions prior to the fixed version
Description The issue is related to a buffer overflow vulnerability in the underlying L2/L3 Management service. This vulnerability could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Recommendations As a temporary workaround, consider disabling the PAPI protocol or restricting access to the UDP port 8211 until a patch is available. For versions prior to the fixed version, update to the latest version to resolve the issue. Restrict access to the vulnerable L2/L3 Management service to minimize the risk of exploitation.

Exploit

Fix

Stack Overflow

Buffer Overflow

Weakness Enumeration

Related Identifiers

BDU:2024-03431
BDU:2024-03552
CVE-2024-26304

Affected Products

Arubaos