CVE-2024-31470
Severity CVSS v4.0:
Pending analysis
Type:
CWE-121
Stack-based Buffer Overflow
Publication date:
14/05/2024
Last modified:
24/06/2025
Description
There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Impact
Base Score 3.x
9.80
Severity 3.x
CRITICAL
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:* | 10.3.0.0 (including) | 10.4.1.1 (excluding) |
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:* | 10.5.0.0 (including) | 10.5.1.1 (excluding) |
cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:* | 6.4.0.0 (including) | 8.6.0.24 (excluding) |
cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:* | 8.7.0.0 (including) | 8.10.0.11 (excluding) |
To consult the complete list of CPE names with products and versions, see this page