CVE-2024-31472

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-31472
There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt Broken Link Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:*
History

24 Jun 2025, 15:15

Type Values Removed Values Added
References
  • () https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US -
References () https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt - Vendor Advisory, Broken Link () https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt - Broken Link, Vendor Advisory
Summary (en) There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. (en) There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.

05 Jun 2025, 15:25

Type Values Removed Values Added
First Time Arubanetworks
Arubanetworks arubaos
Hp instantos
Hp
CPE cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
References () https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt - () https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt - Vendor Advisory, Broken Link

21 Nov 2024, 09:13

Type Values Removed Values Added
References () https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt - () https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt -

03 Jul 2024, 01:54

Type Values Removed Values Added
CWE CWE-78
Summary
  • (es) Existen vulnerabilidades de inyección de comandos en el servicio Soft AP Daemon subyacente que podrían conducir a la ejecución remota de código no autenticado mediante el envío de paquetes especialmente manipulados destinados al puerto UDP (8211) PAPI (protocolo de administración de puntos de acceso de Aruba). La explotación exitosa de estas vulnerabilidades da como resultado la capacidad de ejecutar código arbitrario como usuario privilegiado en el sistema operativo subyacente.

14 May 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-14 23:15

Updated : 2025-06-24 15:15

NVD link : CVE-2024-31472

Mitre link : CVE-2024-31472

CVE.ORG link : CVE-2024-31472

JSON object : View

Products Affected

arubanetworks

  • arubaos

hp

  • instantos
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')