HPE Aruba Networking AOS-8 and AOS-10 Command Injection Vulnerability in CLI Service via PAPI Protocol

A command injection vulnerability has been identified in the command line interface (CLI) service accessed by the PAPI protocol of HPE Aruba Networking AOS-8 and AOS-10 Operating Systems. This vulnerability allows authenticated remote attackers to execute arbitrary commands on the underlying operating system. The issue arises from improper input validation, which could be exploited to inject malicious commands that are executed with elevated privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of commands on the affected system, potentially allowing for a full system compromise.

Remediation

Users can upgrade to AOS-10.8.x.x (10.8.0.1 and above), AOS-10.7.x.x (10.7.2.3 and above), AOS-10.4.x.x (10.4.1.11 and above), AOS-8.13.x.x (8.13.1.2 and above), AOS-8.12.x.x (8.12.0.7 and above) or AOS-8.10.x.x (8.10.0.22 and above). Instructions for downloading the updated software are available on the HPE Networking Support Portal.