CVE-2024-31473
Estado: ModificadaCrítica (9.8)—
There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.65%
- Percentil entre todas las CVEs puntuadas: 76
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-78
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-31473",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-31473",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-05-17T04:00:19.151899Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-alert@hpe.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "security-alert@hpe.com",
"affectedData": [
{
"vendor": "Hewlett Packard Enterprise (HPE)",
"product": "AOS-8 Instant and AOS-10 AP",
"versions": [
{
"status": "affected",
"version": "10.5.0.0",
"versionType": "semver",
"lessThanOrEqual": "10.5.1.0"
},
{
"status": "affected",
"version": "10.4.0.0",
"versionType": "semver",
"lessThanOrEqual": "10.4.1.0"
},
{
"status": "affected",
"version": "8.11.0.0",
"versionType": "semver",
"lessThanOrEqual": "8.11.2.1"
},
{
"status": "affected",
"version": "8.10.0.0",
"versionType": "semver",
"lessThanOrEqual": "8.10.0.10"
},
{
"status": "affected",
"version": "8.6.0.0",
"versionType": "semver",
"lessThanOrEqual": "8.6.0.23"
}
],
"defaultStatus": "unaffected"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.5.0.0:*:*:*:*:*:*:*"
],
"vendor": "arubanetworks",
"product": "arubaos",
"versions": [
{
"status": "affected",
"version": "10.5.0.0",
"versionType": "custom",
"lessThanOrEqual": "10.5.1.0"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.4.0.0:*:*:*:*:*:*:*"
],
"vendor": "arubanetworks",
"product": "arubaos",
"versions": [
{
"status": "affected",
"version": "10.4.0.0",
"versionType": "custom",
"lessThanOrEqual": "10.4.1.0"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.10.0.0:*:*:*:*:*:*:*"
],
"vendor": "arubanetworks",
"product": "instant",
"versions": [
{
"status": "affected",
"version": "8.10.0.0",
"versionType": "custom",
"lessThanOrEqual": "8.10.0.10"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.11.0.0:*:*:*:*:*:*:*"
],
"vendor": "arubanetworks",
"product": "instant",
"versions": [
{
"status": "affected",
"version": "8.11.0.0",
"versionType": "custom",
"lessThanOrEqual": "8.11.2.1"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.6.0.0:*:*:*:*:*:*:*"
],
"vendor": "arubanetworks",
"product": "instant",
"versions": [
{
"status": "affected",
"version": "8.6.0.0",
"versionType": "custom",
"lessThanOrEqual": "8.6.0.23"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:arubaos:10.3.0.0:*:*:*:*:*:*:*"
],
"vendor": "arubanetworks",
"product": "arubaos",
"versions": [
{
"status": "affected",
"version": "10.3.0.0",
"lessThan": "10.4.0.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.9.0.0:*:*:*:*:*:*:*"
],
"vendor": "arubanetworks",
"product": "instant",
"versions": [
{
"status": "affected",
"version": "8.9.0.0",
"lessThan": "8.10.0.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.8.0.0:*:*:*:*:*:*:*"
],
"vendor": "arubanetworks",
"product": "instant",
"versions": [
{
"status": "affected",
"version": "8.8.0.0",
"lessThan": "8.9.0.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.5.0.0:*:*:*:*:*:*:*"
],
"vendor": "arubanetworks",
"product": "instant",
"versions": [
{
"status": "affected",
"version": "8.5.0.0",
"lessThan": "8.6.0.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.7.0.0:*:*:*:*:*:*:*"
],
"vendor": "arubanetworks",
"product": "instant",
"versions": [
{
"status": "affected",
"version": "8.7.0.0",
"lessThan": "8.8.0.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:8.4.0.0:*:*:*:*:*:*:*"
],
"vendor": "arubanetworks",
"product": "instant",
"versions": [
{
"status": "affected",
"version": "8.4.0.0",
"lessThan": "8.5.0.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.5.0.0:*:*:*:*:*:*:*"
],
"vendor": "arubanetworks",
"product": "instant",
"versions": [
{
"status": "affected",
"version": "6.5.0.0",
"lessThan": "6.6.0.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:arubanetworks:instant:6.4.0.0:*:*:*:*:*:*:*"
],
"vendor": "arubanetworks",
"product": "instant",
"versions": [
{
"status": "affected",
"version": "6.4.0.0",
"lessThan": "6.5.0.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2024-05-14T23:15:10.290",
"references": [
{
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US",
"source": "security-alert@hpe.com"
},
{
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de inyección de comandos en el servicio de desautenticación subyacente que podría conducir a la ejecución remota de código no autenticado mediante el envío de paquetes especialmente manipulados destinados al puerto UDP (8211) PAPI (protocolo de administración de puntos de acceso de Aruba). La explotación exitosa de esta vulnerabilidad da como resultado la capacidad de ejecutar código arbitrario como usuario privilegiado en el sistema operativo subyacente."
}
],
"lastModified": "2026-06-17T07:28:29.927",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C22DF47A-ECDC-4FB3-9361-2CE8972F2403",
"versionEndExcluding": "10.4.1.1",
"versionStartIncluding": "10.3.0.0"
},
{
"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3088AE26-C175-4D22-A550-30B97164D15B",
"versionEndExcluding": "10.5.1.1",
"versionStartIncluding": "10.5.0.0"
},
{
"criteria": "cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3EF296DF-98BB-4347-A655-F3046220FFB5",
"versionEndExcluding": "8.6.0.24",
"versionStartIncluding": "6.4.0.0"
},
{
"criteria": "cpe:2.3:o:hp:instantos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5D7CDA65-CB99-4A70-9E12-B38BC7A69F1A",
"versionEndExcluding": "8.10.0.11",
"versionStartIncluding": "8.7.0.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-alert@hpe.com"
}