Article Details
Scrape Timestamp (UTC): 2024-05-01 22:32:59.807
Original Article Text
Click to Toggle View
HPE Aruba Networking fixes four critical RCE flaws in ArubaOS. HPE Aruba Networking has issued its April 2024 security advisory detailing critical remote code execution (RCE) vulnerabilities impacting multiple versions of ArubaOS, its proprietary network operating system. The advisory lists ten vulnerabilities, four of which are critical-severity (CVSS v3.1: 9.8) unauthenticated buffer overflow problems that can lead to remote code execution (RCE). Products impacted by the newly disclosed flaws are: The four critical remote code execution flaws are: To mitigate the flaws the vendor recommends enabling Enhanced PAPI Security and upgrading to patched versions for ArubaOS. The latest versions also address another six vulnerabilities, all rated "medium" in severity (CVSS v3.1: 5.3 – 5.9) which could allow unauthenticated attackers to create denial of service on vulnerable devices and cause costly operational disruptions. The target upgrade versions that address all ten flaws are: At this time, HPE Aruba Networking is not aware of any cases of active exploitation or the existence of proof-of-concept (PoC) exploits for the mentioned vulnerabilities. Still, system administrators are recommended to apply the available security updates as soon as possible.
Daily Brief Summary
HPE Aruba Networking released a security advisory for ArubaOS, highlighting critical remote code execution vulnerabilities.
Four critical-severity vulnerabilities were identified, all of which are unauthenticated buffer overflow issues with a CVSS v3.1 score of 9.8.
These vulnerabilities impact multiple versions of ArubaOS and could allow attackers to remotely execute code.
The advisory also mentioned six other medium-severity vulnerabilities related to potential denial of service attacks.
To protect against these security flaws, HPE Aruba recommends enabling Enhanced PAPI Security and updating to patched versions of ArubaOS.
Updated versions of ArubaOS address all ten reported vulnerabilities, improving system security.
As of now, there are no known active exploitations or proof-of-concept exploits for these vulnerabilities.
System administrators are urged to install the updates immediately to prevent potential breaches and operational disruptions.