Remote Command Execution Vulnerability in HPE Aruba Networking EdgeConnect SD-WAN Gateway
CVE-2024-41135

7.2HIGH

Key Information:

Vendor
HP
Status
HP Aruba Networking Edgeconnect Sd-wan
Vendor
CVE Published:
24 July 2024

Summary

A vulnerability has been identified in the Command Line Interface (CLI) of the HPE Aruba Networking EdgeConnect SD-WAN gateway. This flaw permits remote authenticated users to execute arbitrary commands on the host operating system. Successful exploitation could lead to unauthorized access and complete system compromise, allowing attackers to manipulate the system and potentially gain control over sensitive data and operations.

Affected Version(s)

HPE Aruba Networking EdgeConnect SD-WAN ECOS 9.3.x.x: 9.3.3.0 and below

HPE Aruba Networking EdgeConnect SD-WAN ECOS 9.2.x.x: 9.2.9.0 and below

HPE Aruba Networking EdgeConnect SD-WAN ECOS 9.1.x.x: 9.1.11.0 and below

References

https://csaf.arubanetworks.com/2024/hpe_aruba_networking_...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daniel Jensen (bugcrowd.com/dozernz)
.