Skip to content
OpenAdvisories
Medium WID-SEC-2024-1701 7 CVEs

Aruba EdgeConnect: Mehrere Schwachstellen

Published Jul 23, 2024 · Updated Jul 23, 2024 · de-DE

Vendor: Aruba Product: EdgeConnect Platform: Linux Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Aruba EdgeConnect ausnutzen, um beliebigen Code auszuführen oder um Sicherheitsmaßnahmen zu umgehen.

Product

Aruba EdgeConnect ist eine SD-WAN-Produktfamilie für Unternehmenskunden.

Vulnerabilities 7

  • High 7.2
    CVE-2024-33519

    Authenticated Server-Side prototype pollution Leading to Information Disclosure

    A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allo…

    Hewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeConnect SD-WAN
  • High 7.2
    CVE-2024-41133

    Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface

    A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ab…

    Hewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeConnect SD-WAN
  • High 7.2
    CVE-2024-41134

    Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface

    A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ab…

    Hewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeConnect SD-WAN
  • High 7.2
    CVE-2024-41135

    Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface

    A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ab…

    Hewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeConnect SD-WAN
  • Medium 6.8
    CVE-2024-41136

    Authenticated Command Injection in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface

    An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on …

    Hewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeConnect SD-WAN
  • Medium 6.5
    CVE-2023-51385 Public exploit EPSS 20%

    In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, an…

    openssh openssh openssh-ssh1 openssh Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2023-48795 Public exploit Scanner template EPSS 94%

    Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

    zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io

Revision history

  1. #1

    Initiale Fassung

References