HPE ArubaOS up to 8.10.0.9/8.11.2.0/10.4.0.3/10.5.0.1 Command Line Interface command injection

Summaryinfo

A vulnerability labeled as critical has been found in HPE ArubaOS up to 8.10.0.9/8.11.2.0/10.4.0.3/10.5.0.1. Impacted is an unknown function of the component Command Line Interface. Executing a manipulation can lead to command injection. This vulnerability is tracked as CVE-2024-1356. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in HPE ArubaOS up to 8.10.0.9/8.11.2.0/10.4.0.3/10.5.0.1. It has been declared as critical. This vulnerability affects an unknown part of the component Command Line Interface. The manipulation with an unknown input leads to a command injection vulnerability. The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

The weakness was disclosed 03/06/2024 as ARUBA-PSA-2024-002. The advisory is shared for download at arubanetworks.com. This vulnerability was named CVE-2024-1356 since 02/08/2024. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/28/2025). The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• HPE

Name

• ArubaOS

Version

• 8.10.0.0
• 8.10.0.1
• 8.10.0.2
• 8.10.0.3
• 8.10.0.4
• 8.10.0.5
• 8.10.0.6
• 8.10.0.7
• 8.10.0.8
• 8.10.0.9
• 8.11.0
• 8.11.1
• 8.11.2.0
• 10.4.0.0
• 10.4.0.1
• 10.4.0.2
• 10.4.0.3
• 10.5.0.0
• 10.5.0.1

License

• commercial

Website

• Vendor: https://www.hpe.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion