CVE-2024-33512

published 2024-05-01

CVE-2024-33512: There is a buffer overflow vulnerability in the underlying Local User Authentication Database service that could lead to unauthenticated remote code execution…

Priority P1 79 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

There is a buffer overflow vulnerability in the underlying Local User Authentication Database service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

Detection & IOCs extracted from sources · hover to see the quote

port UDP/8211↗

• → Monitor for unexpected or malformed UDP packets destined to port 8211 (PAPI protocol), which is the attack vector for CVE-2024-33512 exploitation attempts targeting the Local User Authentication Database service. ↗
• → Exploitation results in arbitrary code execution as a privileged user on the underlying OS; look for anomalous privileged process spawning on ArubaOS devices following inbound PAPI traffic. ↗
• → The attack is unauthenticated — no credentials or prior access are required. Any inbound UDP/8211 traffic from untrusted/external sources to Aruba Mobility Controllers, Conductors, WLAN/SD-WAN Gateways should be treated as suspicious. ↗

• · Enabling Enhanced PAPI Security is the vendor-recommended mitigation to reduce exposure to this vulnerability without patching. ↗
• · All EoL ArubaOS and SD-WAN versions are affected and will not receive patches; these include ArubaOS below 10.3, 8.9, 8.8, 8.7, 8.6, 6.5.4, and SD-WAN 2.3.0–8.7.0.0 and 2.2–8.6.0.4. ↗
• · As of the advisory date, no active exploitation or public PoC exploits were known, but patching urgency remains high given the CVSS 9.8 score and unauthenticated attack vector. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121