Vulnerability feed

Executive summary

A memory corruption flaw affects the web-based management interface of AOS-8 products. The advisory says an authenticated, low-privilege attacker with local access could view some system files and disrupt the normal operation of the affected service.

Technical summary

The flaw is a memory corruption vulnerability in the web-based management interface of AOS-8. Exploitation requires an authenticated low-privilege attacker with local access. The advisory says successful exploitation could expose some system files and interrupt the affected service. Affected versions are not stated, and no fixed version is stated. No workaround is stated. No detection guidance is stated. No CVSS score is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

High

Privileges required

Low

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

A buffer overflow flaw in AOS-8 software lets a logged-in attacker with administrator rights crash the system, causing a denial of service. The advisory says a crash could leave the device unable to reboot without manual intervention, disrupting network operations. The advisory does not state a severity score or a vendor fix recommendation.

Technical summary

The flaw is a buffer overflow (CWE class not stated) in AOS-8. Exploitation requires an authenticated attacker with administrative access, and the advisory describes the impact as a system crash that prevents reboot without manual intervention. Affected AOS-8 versions are not stated, and fixed versions are not stated. Workarounds are not stated. Detection guidance is not stated. CVSS score and exploitation status in the wild are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

An arbitrary file deletion flaw exists in the command line interface of AOS-10 products. The advisory says an attacker with administrative login could use it to crash the device, which would stop it from rebooting without manual intervention. The advisory does not state a vendor fix or recommended action.

Technical summary

The vulnerability class is arbitrary file deletion in the AOS-10 command line interface. The attacker must be authenticated with administrative privileges, and the advisory describes the impact as denial of service where the system crashes and cannot reboot without manual intervention. Affected versions, fixed versions, workarounds, and detection guidance are not stated in the advisory. The advisory text is truncated and does not state a CVSS score or whether exploitation has been observed.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

An authentication bypass flaw in the PAPI protocol of AOS-8 lets an unauthenticated remote attacker get around existing login controls. The advisory says successful exploitation allows limited unauthorized changes to certain settings on the affected system. The advisory does not state a severity rating or a vendor-recommended fix.

Technical summary

The flaw is an authentication bypass in the PAPI protocol of AOS-8, reachable remotely by an unauthenticated attacker. Successful exploitation allows limited unauthorized modification of certain settings. The advisory does not state affected or fixed version numbers, a CVSS score, workarounds, or detection guidance, and it does not say whether exploitation in the wild has been observed. Defenders should check the vendor's bulletin for version details and mitigations.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

A stored cross-site scripting flaw affects the web-based management interface of AOS. The advisory says an authenticated attacker with high privileges could inject scripts that run in another logged-in user's browser session.

Technical summary

The vulnerability is stored cross-site scripting in the web-based management interface of AOS. The attacker must be authenticated remotely with high privileges, and successful exploitation runs arbitrary script in another authenticated user's browser session. The advisory text provided is truncated and does not state affected versions, fixed versions, workarounds, CVSS score, or detection guidance, so these are not stated. Exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Changed

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Affects

Hewlett Packard Enterprise (HPE)AOSHewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS

Executive summary

An authentication bypass in the PAPI protocol of AOS-10 lets an unauthenticated attacker on the same local network get around existing login controls. A successful attack can change certain settings on the affected system. The advisory does not state a severity score, and it does not describe a vendor fix or recommended action beyond the description given.

Technical summary

The flaw is an authentication bypass (CWE class not stated) in the PAPI protocol of AOS-10. The attacker must be adjacent to the target and needs no credentials. Successful exploitation lets the attacker change the state of certain settings on the vulnerable system. Affected versions, fixed versions, workarounds, CVSS score, exploitation status, and detection guidance are not stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

An unauthenticated command injection flaw affects the command line interface of AOS-10 products. The advisory says a successful attacker with physical access could run arbitrary commands as a privileged user, leading to complete system compromise.

Technical summary

The vulnerability is a command injection issue in the AOS-10 command line interface that requires no authentication. The advisory states the attack requires physical access to the device and results in arbitrary command execution as a privileged user on the underlying operating system. Affected and fixed version numbers are not stated. No workaround is stated. No detection guidance is stated. Exploitation in the wild and any CVSS score are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Physical

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

A buffer overflow in the API of AOS-10 could let an attacker who already has high-level access and is on the local network run code on the underlying system. The advisory describes the seriousness as high impact but does not state a numeric severity score, and it does not describe a vendor-recommended fix in the text provided.

Technical summary

The flaw is a buffer overflow in the AOS-10 API that can lead to remote code execution as a privileged user on the underlying operating system. The attack requires authentication with high privileges and an adjacent network position, and the advisory does not describe any other preconditions. Affected and fixed version numbers are not stated, no workaround is stated, and no detection guidance is provided. Exploitation in the wild and a CVSS score are also not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

An unauthenticated buffer overflow in the command line interface of AOS-8 could let a remote attacker disrupt the affected interface and access or change some system data. The advisory does not state a severity rating or a score. The advisory does not state what the vendor recommends.

Technical summary

The flaw is a buffer overflow in the command line interface of AOS-8 that requires no authentication. The advisory says a remote unauthenticated attacker could disrupt availability of the affected interface and gain limited access to or modification of some system data. Affected versions are not stated, and no fixed version is stated. No workaround is stated. No CVSS score, exploitation status, or detection guidance is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

A flaw in the PAPI protocol of Alcatel-Lucent Enterprise AOS-8 network software could let an unauthenticated attacker on the same network segment view some limited information and disrupt the affected service. The advisory does not state a severity rating or a score. The advisory does not describe a vendor fix or recommended action in the text provided.

Technical summary

The advisory describes a sensitive information disclosure vulnerability in the PAPI protocol of AOS-8, reachable by an unauthenticated adjacent attacker, which could also affect service availability. No CVSS score or severity rating is stated. Affected and fixed version numbers are not stated. Workarounds and mitigations are not stated. Detection guidance and indicators of compromise are not stated. The advisory text is truncated, so further details may be missing.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

An authentication bypass flaw in the web-based management interface of AOS-10 is reported in this advisory. An unauthenticated attacker on an adjacent network could potentially run arbitrary commands on the underlying host, but only if certain preconditions outside the attacker's control are met. The advisory does not state a severity rating or a vendor-recommended fix.

Technical summary

The vulnerability is an authentication bypass in the web-based management interface of AOS-10, allowing an unauthenticated adjacent attacker to circumvent authentication controls and execute arbitrary commands on the underlying operating system. Exploitation depends on preconditions that the advisory says are outside the attacker's control, and those preconditions are not specified. Affected versions are not stated, fixed versions are not stated, and no workaround is stated. No CVSS score, exploitation-in-the-wild status, or detection guidance is stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

High

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

A buffer overflow in the underlying operating system of Alcatel-Lucent Enterprise AOS-10 and AOS-8 products could let a nearby attacker who needs no login disrupt the affected device. The advisory does not state a severity score, and it does not name a fix or version list in the text provided.

Technical summary

The flaw is a buffer overflow in the underlying operating system of AOS-10 or AOS-8, reachable without authentication by an adjacent attacker. The advisory says exploitation could cause denial of service, with availability impacted and limited integrity impact. Affected versions, fixed versions, workarounds, and CVSS score are not stated in the advisory text provided. Exploitation status in the wild and detection guidance are also not stated. The advisory text appears truncated, so some details may be missing from this copy.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Adjacent network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

Command injection flaws exist in an interface of AOS-10 that let an authenticated attacker with high privileges run commands on the underlying operating system. The advisory does not state a severity score, and it does not describe a fix or workaround.

Technical summary

The vulnerability class is command injection (OS command execution through unsanitized input) in an unspecified interface of AOS-10. Exploitation requires remote network access and an authenticated account with high privileges, and successful exploitation executes arbitrary commands as a privileged user on the underlying operating system. The advisory does not state affected or fixed version numbers, a CVSS score, workarounds, or detection guidance, and it does not say whether exploitation has been observed in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

Command injection flaws exist in an interface of AOS-10, a product from Alcatel-Lucent Enterprise (the advisory names AOS-10 only). An attacker who already holds high privileges on the device could run arbitrary commands on the underlying operating system. The advisory does not state a severity rating or a vendor-recommended fix.

Technical summary

The vulnerability class is command injection (CWE not stated). The attack requires a remote, authenticated user with high privileges, and successful exploitation would let the attacker run arbitrary commands as a privileged user on the operating system. Affected versions are not stated, fixed versions are not stated, no workaround is stated, and no detection guidance is stated. No CVSS score is stated, and the advisory does not say whether the flaw is exploited in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

A buffer overflow in the PAPI protocol of AOS-8 may let a logged-in attacker with high privileges run code remotely on the affected system. The advisory does not state a severity score, and it does not describe a fix or workaround.

Technical summary

The flaw is a buffer overflow in the PAPI protocol of AOS-8, which can lead to remote code execution as a privileged user on the underlying operating system. Exploitation requires an authenticated attacker with high privileges and network access to the protocol. Affected and fixed version numbers are not stated. Workarounds, mitigations, and detection guidance are not stated. A CVSS score is not stated, and exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

Command injection vulnerabilities in the AOS-8 product's affected interface have been reported. The advisory says an attacker who is already authenticated with high privileges could run commands on the underlying operating system.

Technical summary

The flaw is classified as command injection, which allows crafted input to be interpreted as operating system commands. The attack vector is remote, but the attacker must be authenticated with high privileges. Commands run with the privileges of the impacted mechanism on the underlying operating system. The advisory does not state affected versions, fixed versions, workarounds, exploitation in the wild, a CVSS score, or detection guidance. The specific affected interface is not named in the text provided.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

Command injection flaws in an interface of AOS-8 could let a logged-in remote attacker with high privileges run commands on the underlying system. The advisory does not state a severity rating or a fix for the issue.

Technical summary

The advisory describes command injection vulnerabilities in the affected interface of AOS-8. Exploitation requires a remote attacker who is authenticated and holds high privileges. Successful exploitation would let the attacker execute commands with the privileges of the impacted mechanism on the underlying operating system. Affected versions, fixed versions, workarounds, CVSS score, and detection guidance are not stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

A flaw in the web-based management interface of wireless network management systems could let a logged-in remote attacker run code on the underlying system. The advisory describes this as potentially compromising system integrity and data security. The advisory does not state a severity rating or a vendor fix recommendation.

Technical summary

The vulnerability is a remote code execution flaw in the web-based management interface of wireless network management systems. The attacker must be authenticated, and successful exploitation could allow arbitrary operating system commands to be executed. The advisory does not name affected vendors, products, or versions. Affected versions, fixed versions, workarounds, CVSS score, and detection guidance are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

A flaw in the command-line handling of the AOS-8 web interface may let a logged-in remote attacker run unauthorized commands on the underlying operating system. The advisory says successful exploitation could lead to full system compromise. The advisory does not state a severity rating or a vendor fix.

Technical summary

The advisory describes a command injection vulnerability in the CLI command handling of the AOS-8 web interface, which allows arbitrary operating system command execution. The attack requires an authenticated remote attacker, so valid credentials are a precondition. Affected versions, fixed versions, workarounds, CVSS score, and detection guidance are not stated in the advisory text provided.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

An unauthenticated memory corruption flaw exists in a service reached through the PAPI protocol in AOS-8. The advisory says a remote attacker without credentials could use it to cause a denial of service and disrupt the affected service. The advisory text provided does not state a severity rating or a vendor fix recommendation.

Technical summary

The flaw is a memory corruption vulnerability in a service accessed via the PAPI protocol in AOS-8, and it requires no authentication. A remote attacker could exploit it to cause a denial of service. The advisory text is truncated, and it does not state affected versions, fixed versions, workarounds, CVSS score, or detection guidance. Exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

A flaw in an interface of AOS-10 could let an unauthenticated remote attacker cause a denial of service, disrupting the availability of that interface. The advisory does not state a severity score for this issue. The advisory does not state a fix or recommended action.

Technical summary

The advisory describes a denial of service vulnerability in the affected interface of AOS-10, reachable by an unauthenticated remote attacker. Successful exploitation would disrupt availability of that interface. The specific vulnerability class, the affected interface name, and the affected AOS-10 versions are not stated. Fixed versions, workarounds, CVSS score, and detection guidance are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

An unauthenticated denial-of-service flaw exists in the PAPI protocol of AOS-8, a product line that the advisory names but does not describe further. A successful attack can disrupt the availability of the affected interface. The advisory does not state a severity rating or any vendor fix or recommendation.

Technical summary

The flaw is classified as a denial-of-service vulnerability in the PAPI protocol of AOS-8 and can be triggered without authentication. Successful exploitation disrupts availability of the affected interface. The advisory does not state the attack vector, required network position, affected or fixed version numbers, workarounds, or any detection guidance. It also does not state whether exploitation has been observed in the wild or give a CVSS score.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Executive summary

Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to cause a denial of service. Successful exploitation could disrupt the availability of the affected service. The advisory does not state a severity score or a fix.

Technical summary

The advisory describes memory corruption vulnerabilities in AOS-10 that can be triggered by an unauthenticated remote attacker, leading to denial of service. The vulnerability class is memory corruption, and the advisory does not give specific details of the vulnerable component. Affected AOS-10 versions are not stated. Fixed versions are not stated. Workarounds are not stated. Detection guidance and CVSS score are not stated, and exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-10Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-10

Executive summary

A memory corruption flaw affects AOS-8 software. The advisory says an attacker who already has a local login could run arbitrary code with privileged access on the underlying operating system. The advisory does not state a severity rating or a vendor-recommended fix.

Technical summary

The flaw is a memory corruption vulnerability in AOS-8. The attack requires an authenticated local attacker, and successful exploitation could allow arbitrary code execution as a privileged user on the underlying operating system. Affected and fixed versions are not stated in the advisory. A CVSS score is not stated. Workarounds and detection guidance are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)AOS-8Hewlett Packard Enterprise (HPE) ArubaOS (AOS)AOS-8

Executive summary

A buffer overflow in the command line interface of AOS-8 could let an unauthenticated remote attacker run commands on the underlying host, potentially giving full control of the system. The advisory describes this as serious, noting it could lead to complete system compromise, but only if certain preconditions outside the attacker's control are met. The advisory does not state a fix or vendor recommendation.

Technical summary

The flaw is a buffer overflow in the AOS-8 command line interface that can be reached remotely without authentication. Exploitation requires certain preconditions outside the attacker's control, which the advisory does not specify. Successful exploitation could lead to arbitrary code execution as a privileged user on the underlying operating system. Affected and fixed versions are not stated, no workaround is stated, and no detection guidance is stated. The advisory text is truncated, so further details may be missing.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Dropped extracted product not named in the source: Aruba AOS-8

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Hewlett Packard Enterprise (HPE)Hewlett Packard Enterprise (HPE) ArubaOS (AOS)