CVE-2024-42394: Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the Soft AP Daemon Service Accessed by the PAPI Protocol
First published: Tue Aug 06 2024(Updated: )
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Credit: security-alert@hpe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ArubaOS | >=10.3.0.0<10.4.1.4 | |
| ArubaOS | >=10.5.0.0<10.6.0.1 | |
| hp InstantOS | >=6.4.0.0<8.10.0.13 | |
| hp InstantOS | >=8.12.0.0<8.12.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-42394?
CVE-2024-42394 is categorized as a critical vulnerability due to the possibility of unauthenticated remote code execution.
How do I fix CVE-2024-42394?
To fix CVE-2024-42394, update vulnerable versions of ArubaOS and HP InstantOS to the latest secure releases.
What are the affected software versions for CVE-2024-42394?
CVE-2024-42394 affects ArubaOS versions from 10.3.0.0 to 10.4.1.4 and 10.5.0.0 to 10.6.0.1, as well as HP InstantOS versions from 6.4.0.0 to 8.10.0.13 and 8.12.0.0 to 8.12.0.2.
What could an attacker achieve by exploiting CVE-2024-42394?
Exploiting CVE-2024-42394 could allow an attacker to execute arbitrary commands, leading to complete system compromise.
Is authentication required to exploit CVE-2024-42394?
No, CVE-2024-42394 can be exploited without authentication, making it particularly dangerous.
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/arubanetworks
- canonical/arubaos
- version/arubaos/10.3.0.0
- version/arubaos/10.5.0.0
- vendor/hp
- canonical/hp instantos
- version/hp instantos/6.4.0.0
- version/hp instantos/8.12.0.0