About:
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
Identifier: CVE-2024-42505
CVSS Score: 9.8 (Critical)
Update Guide: Visit the Aruba Support Portal for detailed instructions on patching and updates.
Description: CVE-2024-42505 is a critical vulnerability in ArubaOS, affecting certain versions of wireless controllers and access points. This flaw allows for command injection through the PAPI (Aruba's Access Point management protocol), which runs on UDP port 8211. If exploited, an unauthenticated attacker can remotely execute arbitrary code on the system, potentially leading to a full compromise of the affected device and associated networks.
Affected Versions:
Note: Some versions have reached End of Support Life (EoSL), such as AOS-10.5.x.x and Instant AOS-8.11.x.x, and are not covered by this advisory. It is strongly recommended to upgrade to a supported version.
1. Download the Patch:
Aruba Networks has released updates to mitigate CVE-2024-42505. To secure your devices:
2. Apply Specific Patch Versions:
To address CVE-2024-42505, upgrade to the following versions or higher:
3. Enable Cluster Security (for Instant AOS-8 Devices):
4. Block PAPI Port for AOS-10 Devices:
After applying the patch:
Since "cluster-security" is unavailable for AOS-10 devices, block access to UDP port 8211 from untrusted networks to prevent remote exploitation.
5. Verify Patch Deployment:
Further Details: For more technical details on the vulnerability, you can refer to the National Vulnerability Database entry for CVE-2024-42505. Immediate action is recommended due to the severity and potential impact of this vulnerability on network security.
Identifier: CVE-2024-42506
CVSS Score: 8.8 (High)
Update Guide: Visit the Aruba Support Portal for patches and further guidance on mitigating this vulnerability.
Description: CVE-2024-42506 is a high-severity vulnerability within ArubaOS, which affects certain Aruba wireless controllers and access points. This vulnerability arises due to improper access control mechanisms within certain API endpoints. Attackers who have limited access can exploit this flaw to escalate their privileges, potentially allowing them to execute arbitrary commands or modify configurations on the affected device.
Affected Versions:
Note: Some versions of ArubaOS have reached End of Support Life (EoSL), such as AOS-10.5.x.x and Instant AOS-8.11.x.x. Users running these versions are strongly advised to upgrade to a supported version immediately.
1. Download the Patch:
Aruba Networks has released software updates to mitigate CVE-2024-42506. To secure your devices:
2. Apply the Appropriate Patch Version:
To address CVE-2024-42506, Aruba recommends upgrading to the following versions or later:
3. Verification of the Patch:
4. Post-Patch Security Measures:
After applying the patch:
Further Details: For detailed technical information on CVE-2024-42506, please refer to the National Vulnerability Database entry: CVE-2024-42506. Immediate patching is strongly advised to prevent any potential exploitation and to maintain the integrity and security of the Aruba network devices.
Identifier: CVE-2024-42507
CVSS Score: 9.4 (Critical)
Update Guide: Visit the Aruba Support Portal for downloading patches and further details on remediation.
Description: CVE-2024-42507 is a critical vulnerability affecting ArubaOS, which is present in specific versions of wireless controllers and access points. This flaw allows unauthenticated attackers to bypass security controls by sending specially crafted network packets, which could lead to unauthorized access to sensitive system functions and potentially result in a compromise of the device and network security.
Affected Versions:
Note: Several versions of ArubaOS have reached End of Support Life (EoSL), such as AOS-10.5.x.x and Instant AOS-8.11.x.x. It is strongly advised for users on these versions to upgrade immediately to a supported version.
1. Download the Patch:
Aruba Networks has provided patches to mitigate CVE-2024-42507. To secure your devices:
2. Apply the Appropriate Patch Version:
To address this vulnerability, update your systems to one of the following patched versions:
3. Verification of the Patch:
4. Ongoing Security Measures:
Further Details: For more technical details on CVE-2024-42507, you can refer to the National Vulnerability Database entry: CVE-2024-42507. Aruba Networks recommends that all users of affected devices apply patches promptly to prevent any potential exploitation and to secure the integrity of their network environments.