CVE-2020-24636

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.17 and below; Aruba Instant 8.3.x: 8.3.0.13 and below; Aruba Instant 8.5.x: 8.5.0.10 and below; Aruba Instant 8.6.x: 8.6.0.5 and below; Aruba Instant 8.7.x: 8.7.0.0 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Mar 29, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-246377.2Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerabiliCVE-2020-246387.2Multiple authenticated remote command executions are possible in Airwave Glass before 1.3.3 via the glassadmin cli. These allow for a user wCVE-2020-246399.8There is a vulnerability caused by unsafe Java deserialization that allows for arbitrary command execution in a containerized environment wiCVE-2020-246409.8There is a vulnerability caused by insufficient input validation that allows for arbitrary command execution in a containerized environment CVE-2020-246417.5In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if succesCVE-2020-246469.8A tftpserver stack-based buffer overflow remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) versiCVE-2020-246479.8A remote accessmgrservlet classname input validation code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) CVE-2020-246489.8A accessmgrservlet classname deserialization of untrusted data remote code execution vulnerability was discovered in HPE Intelligent ManagemCVE-2020-246499.8A remote bytemessageresource transformentity" input validation code execution vulnerability was discovered in HPE Intelligent Management CenCVE-2020-246509.8A legend expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) versionCVE-2020-246519.8A syslogtempletselectwin expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management CentCVE-2020-246529.8A addvsiinterfaceinfo expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center