CVE-2024-47460

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
Hewlett Packard Enterprise (HPE)HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10>= AOS-10.4.x.x: 10.4.1.4 and below, <= <=10.4.1.4; >= Instant AOS-8.12.x.x: 8.12.0.2 and below, <= <=8.12.0.2; >= Instant AOS-8.10.x.x: 8.10.0.13 and below, <= <=8.10.0.13
arubanetworksarubaos>= 10.4.0.0, <= 10.4.1.4; >= 10.3.0.0, < 10.4.0.0; >= 10.5.0.0, < 10.7.0.0
arubanetworksinstant>= 8.12.0.0, <= 8.12.0.2; >= 8.10.0.0, <= 8.10.0.13; >= 6.4.0.0, < 6.6.0.0; >= 8.4.0.0, < 8.10.0.0; >= 8.11.0.0, < 8.12.0.0

References

Timeline

Published
Nov 5, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-474617.2An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation ofCVE-2024-474627.2An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnCVE-2024-474637.2An arbitrary file creation vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. Successful exploitation of this vulnCVE-2024-474646.8An authenticated Path Traversal vulnerability exists in Instant AOS-8 and AOS-10. Successful exploitation of this vulnerability allows an atCVE-2024-47477.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Propovoice Propovoice CRM allows StoreCVE-2024-474755.5Dell PowerScale OneFS 8.2.2.x through 9.8.0.x contains an incorrect permission assignment for critical resource vulnerability. A locally autCVE-2024-474767.8Dell NetWorker Management Console, version(s) 19.11, contain(s) an Improper Verification of Cryptographic Signature vulnerability. An unauthCVE-2024-474776.5Dell PowerFlex Manager, versions prior to 4.5.1.1, contain an improper certificate validation vulnerability. A remote unauthenticated attackCVE-2024-47487.8The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server.  The exploitationCVE-2024-474807.8Dell Inventory Collector Client, versions prior to 12.7.0, contains an Improper Link Resolution Before File Access vulnerability. A low-privCVE-2024-474816.5Dell Data Lakehouse, version(s) 1.0.0.0, 1.1.0., contain(s) an Improper Access Control vulnerability. An unauthenticated attacker with adjacCVE-2024-474835.5Dell Data Lakehouse, version(s) 1.0.0.0 and 1.1.0.0, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL