certfr_avis - certfr-2025-avi-0017

CERTFR-2025-AVI-0017

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans les produits HPE Aruba Networking. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

L'éditeur indique que les versions 10.10.x sont affectées mais ne bénéficieront pas de correctifs de sécurité.

Impacted products

Vendor	Product	Description
HPE Aruba Networking	AOS-CX	AOS-CX versions 10.15.x antérieures à 10.15.1000
HPE Aruba Networking	AOS-CX	AOS-CX versions 10.14.x antérieures à 10.14.1030
HPE Aruba Networking	AOS-CX	AOS-CX versions antérieures à 10.13.1070

References

Title

Publication Time

Tags

Bulletin de sécurité HPE Aruba Networking HPESBNW04772

2025-01-08

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "AOS-CX versions 10.15.x ant\u00e9rieures \u00e0 10.15.1000",
      "product": {
        "name": "AOS-CX",
        "vendor": {
          "name": "HPE Aruba Networking",
          "scada": false
        }
      }
    },
    {
      "description": "AOS-CX versions 10.14.x ant\u00e9rieures \u00e0 10.14.1030",
      "product": {
        "name": "AOS-CX",
        "vendor": {
          "name": "HPE Aruba Networking",
          "scada": false
        }
      }
    },
    {
      "description": "AOS-CX versions ant\u00e9rieures \u00e0 10.13.1070",
      "product": {
        "name": "AOS-CX",
        "vendor": {
          "name": "HPE Aruba Networking",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "L\u0027\u00e9diteur indique que les versions 10.10.x sont affect\u00e9es mais ne b\u00e9n\u00e9ficieront pas de correctifs de s\u00e9curit\u00e9.",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-54010",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-54010"
    }
  ],
  "initial_release_date": "2025-01-09T00:00:00",
  "last_revision_date": "2025-01-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0017",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-01-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits HPE Aruba Networking. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits HPE Aruba Networking",
  "vendor_advisories": [
    {
      "published_at": "2025-01-08",
      "title": "Bulletin de s\u00e9curit\u00e9 HPE Aruba Networking HPESBNW04772",
      "url": "https://csaf.arubanetworks.com/2025/hpe_aruba_networking_-_hpesbnw04772.txt"
    }
  ]
}

CVE-2024-54010 (GCVE-0-2024-54010)

Vulnerability from cvelistv5

Published

2025-01-08 20:42

Modified

2025-01-31 17:57

Severity ?

3.4 (Low) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Summary

A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to conduct a packet forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leading to unauthorized data exposure.

References

URL

Tags

https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04772.txt

Impacted products

	Vendor	Product	Version
	Hewlett Packard Enterprise (HPE)	AOS-CX	Version: Version 10.10.0000: 10.10.1140 and below ≤ <=10.10.1140 Version: Version 10.13.0000: 10.13.1060 and below ≤ <=10.13.1060 Version: Version 10.14.0000: 10.14.1020 and below ≤ <=10.14.1020 Version: Version 10.15.0000: 10.15.0005 and below ≤ <=10.15.0005

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-54010",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-09T16:31:10.583426Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-863",
                "description": "CWE-863 Incorrect Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-31T17:57:52.529Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory"
            ],
            "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04772en_us\u0026docLocale=en_US"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "AOS-CX",
          "vendor": "Hewlett Packard Enterprise (HPE)",
          "versions": [
            {
              "lessThanOrEqual": "\u003c=10.10.1140",
              "status": "affected",
              "version": "Version 10.10.0000: 10.10.1140 and below",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=10.13.1060",
              "status": "affected",
              "version": "Version 10.13.0000: 10.13.1060 and below",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=10.14.1020",
              "status": "affected",
              "version": "Version 10.14.0000: 10.14.1020 and below",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "\u003c=10.15.0005",
              "status": "affected",
              "version": "Version 10.15.0000: 10.15.0005 and below",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "DXC"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches  exists. It could allow an unauthenticated adjacent attacker to conduct a packet  forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leading to unauthorized data exposure.\u003c/p\u003e"
            }
          ],
          "value": "A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches  exists. It could allow an unauthenticated adjacent attacker to conduct a packet  forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leading to unauthorized data exposure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-08T20:42:21.216Z",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04772.txt"
        }
      ],
      "source": {
        "advisory": "HPESBNW04772",
        "discovery": "EXTERNAL"
      },
      "title": "Unauthenticated Traffic Handling Flaw Allows Packet Leakage on   HPE Aruba Networking CX 10000 series switches",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2024-54010",
    "datePublished": "2025-01-08T20:42:21.216Z",
    "dateReserved": "2024-11-26T21:55:16.390Z",
    "dateUpdated": "2025-01-31T17:57:52.529Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2025-AVI-0017

Vulnerability from certfr_avis

Solutions

CVE-2024-54010 (GCVE-0-2024-54010)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature