CVE-2020-24634: Command Injection
An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP Management protocol) UDP port (8211) of access-pointsor controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-24634?
CVE-2020-24634 is a vulnerability that allows an attacker to remotely inject arbitrary commands by sending specially crafted packets to the PAPI UDP port of Aruba access-points or controllers.
Which software is affected by CVE-2020-24634?
ArubaOS versions 8.2.2.10, 8.3.0.0 to 8.3.0.14, 8.4.0.0 to 8.5.0.11, 8.6.0.0 to 8.6.0.6, and 8.7.0.0 to 8.7.1.0 are affected by CVE-2020-24634.
How severe is CVE-2020-24634?
CVE-2020-24634 has a severity rating of 9.8, which is classified as critical.
What is the Common Weakness Enumeration (CWE) ID for CVE-2020-24634?
The CWE ID for CVE-2020-24634 is 77.
How can I fix CVE-2020-24634?
It is recommended to update ArubaOS to a patched version provided by Aruba Networks.