CVE-2024-1356
published 2024-03-05CVE-2024-1356: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the…
PriorityP348high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
1.24%
65.4th percentile
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arubanetworks | arubaos | 10.4.0.0 – 10.4.0.3 | — |
| arubanetworks | arubaos | 10.5.0.0 – 10.5.0.1 | — |
| arubanetworks | arubaos | 8.10.0.0 – 8.10.0.9 | — |
| arubanetworks | arubaos | 8.11.0.0 – 8.11.2.0 | — |
| hewlett_packard_enterprise | arubaos_wi-fi_controllers_and_campus_remote_access_points | — | — |
| hewlett_packard_enterprise | arubaos_wi-fi_controllers_and_campus_remote_access_points | — | — |
| hewlett_packard_enterprise | arubaos_wi-fi_controllers_and_campus_remote_access_points | — | — |
| hewlett_packard_enterprise | arubaos_wi-fi_controllers_and_campus_remote_access_points | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-849m-v6gh-gmf9: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
ghsa_unreviewed·2024-03-05
CVE-2024-1356 [HIGH] CWE-77 GHSA-849m-v6gh-gmf9: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Red Hat
kernel: Bluetooth: ISO: Check socket flag instead of hcon
vendor_redhat·2024-07-30·CVSS 5.5
CVE-2024-42141 [MEDIUM] kernel: Bluetooth: ISO: Check socket flag instead of hcon
kernel: Bluetooth: ISO: Check socket flag instead of hcon
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: Check socket flag instead of hcon
This fixes the following Smatch static checker warning:
net/bluetooth/iso.c:1364 iso_sock_recvmsg()
error: we previously assumed 'pi->conn->hcon' could be null (line 1359)
net/bluetooth/iso.c
1347 static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1348 size_t len, int flags)
1349 {
1350 struct sock *sk = sock->sk;
1351 struct iso_pinfo *pi = iso_pi(sk);
1352
1353 BT_DBG("sk %p", sk);
1354
1355 if (test_and_clear_bit(BT_SK_DEFER_SETUP,
&bt_sk(sk)->flags)) {
1356 lock_sock(sk);
1357 switch (sk->sk_state) {
1358 case BT_CONNECT2:
1359 if (pi->conn->hcon &&
^^^^^^^^^^^^^^ If ->hcon is NULL
1360 test_bi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-03-05
Published