CVE-2024-31467

The vulnerability results from a stack-based buffer overflow (CWE-121) in the CLI service protocol handling layer. The attacker sends specially crafted UDP packets to port 8211, used by the PAPI protocol (Aruba's Access Point management protocol). Improper handling of incoming data causes buffer overflow, which enables taking control over program execution flow and running arbitrary code.

Successful exploitation of the vulnerability allows an attacker to execute arbitrary code with the privileges of a privileged user at the operating system level of the device. In practice, this means complete takeover of the device, including the ability to modify configuration, leak data, and perform further lateral movement in the network.

Apply patches available from the manufacturer according to the references: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us and https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt. Additionally, if immediate updates are not possible, it is recommended to restrict access to UDP port 8211 (PAPI) exclusively to trusted sources using a firewall or ACL.

Devices running Aruba ArubaOS and HP InstantOS software — versions indicated in the manufacturer's references (ARUBA-PSA-2024-006 and HPE Security Bulletin hpesbnw04647en_us)