Summary
HPE heeft kwetsbaarheden verholpen in HPE Aruba Networking EdgeConnect SD-WAN Gateways.
Details
Interpretaties
De kwetsbaarheden bevinden zich in de command-line interface en web API van de HPE Aruba Networking EdgeConnect SD-WAN Gateways. Deze kwetsbaarheden stellen geauthenticeerde aanvallers in staat om willekeurige systeemcommando's uit te voeren met root-toegang, shell-toegang te verkrijgen, en processen te beëindigen, wat kan leiden tot ongeautoriseerde controle en destabilisatie van de systemen. Dit kan ook resulteren in het uitlekken van gevoelige gegevens en het omzeilen van bestaande firewallbescherming.
Oplossingen
HPE heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 9
-
High 8.8
Authenticated Command Injection leads to Unauthorized Actions in CLI Interface
A vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary s…
-
High 8.6
Unauthenticated Access Vulnerability allows Transit Traffic Misrouting in SD-WAN Edge Interface
A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. Successful exploitation could allow an attacker to route potentially harmful traffic through the internal network, leadi…
-
High 7.5
Broken access control vulnerability in Firewall Configuration Leads to Unauthorized Access to Internal Network Resources
A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker to bypass firewall protections, potentially leading to unauthorized traffic being handled improperly
-
High 7.2
Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the abi…
-
High 7.2
Authenticated Replay Attack contains Cryptographic Vulnerability
A vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell access. Successful exploitation could allow an attacker to execute arbitrary commands on the underly…
-
Medium 6.8
Authenticated Arbitrary Process Termination allows potential System Disruption in ECOS
A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running processes. Successful exploitation could allow an attacker to disrupt system operations, potentially…
-
Medium 6.7
Authenticated Remote Code Execution allows Exploit in Scripts Feature
A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilities. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying o…
-
Medium 6.5
Unrestricted Binary allows File Enumeration in Underlying Operating System
A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful exploitation could allow an attacker to read sensitive data from the underlying file system.
-
Medium 4.9
Authenticated Arbitrary File Read allows Data Exposure in CLI Interface
A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files. Under certain conditions, this could lead to exposure and exfiltration of sensitive information.
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04943en_us&docLocale=en_US