CVE-2024-26294: Command Injection
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26294?
CVE-2024-26294 is rated as a critical vulnerability due to its potential to allow remote authenticated users to execute arbitrary commands as root.
How do I fix CVE-2024-26294?
To fix CVE-2024-26294, update your Aruba ClearPass Policy Manager to the latest version or apply the necessary patches recommended by Aruba Networks.
Who is affected by CVE-2024-26294?
CVE-2024-26294 affects users of Aruba ClearPass Policy Manager versions 6.9.0 to 6.9.13, 6.10.0 to 6.10.8, and 6.11.0 to 6.11.6.
What could happen if CVE-2024-26294 is exploited?
Exploitation of CVE-2024-26294 could allow an attacker to execute arbitrary commands on the underlying operating system, leading to full system compromise.
When was CVE-2024-26294 published?
CVE-2024-26294 was published in 2024, detailing vulnerabilities that allow unauthorized command execution through the ClearPass Policy Manager.