CVE-2024-31472

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	AOS-8 Instant and AOS-10 AP	>= 10.5.0.0, <= 10.5.1.0; >= 10.4.0.0, <= 10.4.1.0; >= 8.11.0.0, <= 8.11.2.1; >= 8.10.0.0, <= 8.10.0.10; >= 8.6.0.0, <= 8.6.0.23
arubanetworks	arubaos	>= 10.5.0.0, <= 10.5.1.0
arubanetworks	arubaos	>= 10.4.0.0, <= 10.4.1.0
arubanetworks	instant	>= 8.10.0.0, <= 8.10.0.10
arubanetworks	instant	>= 8.11.0.0, <= 8.11.2.1
arubanetworks	instant	>= 8.6.0.0, <= 8.6.0.23
arubanetworks	arubaos	>= 10.3.0.0, < 10.4.0.0
arubanetworks	instant	>= 8.9.0.0, < 8.10.0.0
arubanetworks	instant	>= 8.8.0.0, < 8.9.0.0
arubanetworks	instant	>= 8.5.0.0, < 8.6.0.0
arubanetworks	instant	>= 8.7.0.0, < 8.8.0.0
arubanetworks	instant	>= 8.4.0.0, < 8.5.0.0
arubanetworks	instant	>= 6.5.0.0, < 6.6.0.0
arubanetworks	instant	>= 6.4.0.0, < 6.5.0.0

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txtBroken Link, Vendor Advisory

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-314739.8There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated remote code executi CVE-2024-314748.2There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful CVE-2024-314758.2There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management pr CVE-2024-314768.8Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabiliti CVE-2024-314778.8Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabiliti CVE-2024-314787.5Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol. Successful exp CVE-2024-314797.5Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol. Successf CVE-2024-31488.8A vulnerability, which was classified as critical, has been found in DedeCMS 5.7.112. This issue affects some unknown processing of the file CVE-2024-314807.5Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of CVE-2024-314817.5Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of CVE-2024-314827.5An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol. Successful e CVE-2024-314836.5An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol. Successful exploit