CVE-2024-42394

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787 CWE-200

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10	>= Version 8.12.0.0: 8.12.0.1 and below, <= <=8.12.0.1; >= Version 8.10.0.0: 8.10.0.12 and below, <= <=8.10.0.12
hpe	aruba_networking_instantos	<= 8.12.0.1; <= 8.10.0.12
hpe	arubaos	<= 8.12.0.1; <= 8.10.0.12

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04678en_us&docLocale=en_USVendor Advisory

Timeline

Published: Aug 6, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-423959.8There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack.CVE-2024-423965.3Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protoco CVE-2024-423975.3Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protoco CVE-2024-423985.3Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful expl CVE-2024-423995.3Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful expl CVE-2024-42408.8A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been classified as critical. This affects the function formQosManageDouble_user.CVE-2024-424005.3Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful expl CVE-2024-424048.8SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the inf CVE-2024-424056.7Uncontrolled search path for some Intel(R) Quartus(R) Prime Software before version 23.1.1 Patch 1.01std may allow an authenticated user to CVE-2024-424065.4Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing a CVE-2024-424078.5Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenti CVE-2024-424083.7The InfoScan client download page can be intercepted with a proxy, to expose filenames located on the system, which could lead to additiona