CVE-2024-42501

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An authenticated Path Traversal vulnerabilities exists in the ArubaOS. Successful exploitation of this vulnerability allows an attacker to install unsigned packages on the underlying operating system, enabling the threat actor to execute arbitrary code or install implants.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
Hewlett Packard Enterprise (HPE)Aruba OS>= Version 10.6.0.0: 10.6.0.2 and below, <= <=10.6.0.2; >= Version 8.10.0.0: 8.10.0.13 and below, <= <=8.10.0.13; >= Version 10.5.0.0: 10.6.0.0 and below, <= <=10.6.0.0; >= Version 10.3.0.0: 10.4.0.0 and below, <= <=10.4.0.0; >= Version 8.11.0.0: 8.12.0.0 and below, <= <=8.12.0.0; >= Version 8.12.0.0: 8.12.0.1 and below, <= <=8.12.0.1; >= Version 6.5.4.0: 8.9.0.0 and below, <= <=8.9.0.0
arubanetworksarubaos>= 10.6.0.0, <= 10.6.0.2; >= 8.10.0.0, <= 8.10.0.13; >= 10.5.0.0, <= 10.6.0.0; >= 10.3.0.0, <= 10.4.0.0; >= 8.11.0.0, <= 8.12.0.0; >= 8.12.0.0, <= 8.12.0.1; >= 6.5.4.0, <= 8.9.0.0

References

Timeline

Published
Sep 17, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-425027.2Authenticated command injection vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability reCVE-2024-425037.2Authenticated command execution vulnerability exist in the ArubaOS command line interface (CLI). Successful exploitation of this vulnerabilCVE-2024-425044.3A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a Cross-Site Request Forgery (CSRF) in the loginCVE-2024-425059.8Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially craCVE-2024-425069.8Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially craCVE-2024-425079.8Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially craCVE-2024-425085.5This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users.CVE-2024-425099.8Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially craftCVE-2024-42518.8A vulnerability was found in Tenda i21 1.0.0.14(4656). It has been rated as critical. Affected by this issue is the function fromDhcpSetSer CVE-2024-425128.6Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication whenCVE-2024-425135.3Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication whenCVE-2024-425148.1A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to