Aruba Networking EdgeConnect SD-WAN Gateways Command Injection Vulnerability

CVE-2024-41136
8.8HIGH

Key Information

Vendor
Hewlett Packard Enterprise (HP)
Status
HP Aruba Networking Edgeconnect Sd-wan
Vendor
CVE Published:
24 July 2024

Summary

An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

Affected Version(s)

HPE Aruba Networking EdgeConnect SD-WAN <= ECOS 9.3.x.x: 9.3.3.0 and below

HPE Aruba Networking EdgeConnect SD-WAN <= ECOS 9.2.x.x: 9.2.9.0 and below

HPE Aruba Networking EdgeConnect SD-WAN <= ECOS 9.1.x.x: 9.1.11.0 and below

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database

Credit

Daniel Jensen (bugcrowd.com/dozernz)
.