CVE-2024-31471

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-31471
There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt Broken Link Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:*
History

24 Jun 2025, 15:15

Type Values Removed Values Added
Summary (en) There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system. (en) There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
References
  • () https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US -
References () https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt - Vendor Advisory, Broken Link () https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt - Broken Link, Vendor Advisory

05 Jun 2025, 15:25

Type Values Removed Values Added
References () https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt - () https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt - Vendor Advisory, Broken Link
CPE cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
First Time Arubanetworks
Arubanetworks arubaos
Hp instantos
Hp

21 Nov 2024, 09:13

Type Values Removed Values Added
References () https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt - () https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt -

03 Jul 2024, 01:54

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad de inyección de comandos en el servicio de Comunicaciones Centrales subyacente que podría conducir a la ejecución remota de código no autenticado mediante el envío de paquetes especialmente manipulados destinados al puerto UDP (8211) PAPI (protocolo de administración de puntos de acceso de Aruba). La explotación exitosa de esta vulnerabilidad da como resultado la capacidad de ejecutar código arbitrario como usuario privilegiado en el sistema operativo subyacente.
CWE CWE-78

14 May 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-14 23:15

Updated : 2025-06-24 15:15

NVD link : CVE-2024-31471

Mitre link : CVE-2024-31471

CVE.ORG link : CVE-2024-31471

JSON object : View

Products Affected

arubanetworks

  • arubaos

hp

  • instantos
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')