CVE-2024-33519: A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to…

PriorityP350high7.2CVSS 3.1

AVNACLPRHUINSUCHIHAH

EPSS

0.70%

48.6th percentile

A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
hewlett_packard_enterprise	hpe_aruba_networking_edgeconnect_sd-wan	ECOS 8.0.x.x: all builds are affected and are out of maintenance. – <=8.0.x.x	—
hewlett_packard_enterprise	hpe_aruba_networking_edgeconnect_sd-wan	ECOS 9.0.x.x: all builds are affected and are out of maintenance. – <=9.0.x.x	—
hewlett_packard_enterprise	hpe_aruba_networking_edgeconnect_sd-wan	ECOS 9.1.x.x: 9.1.11.0 and below – <=9.1.11.0	—
hewlett_packard_enterprise	hpe_aruba_networking_edgeconnect_sd-wan	ECOS 9.2.x.x: 9.2.9.0 and below – <=9.2.9.0	—
hewlett_packard_enterprise	hpe_aruba_networking_edgeconnect_sd-wan	ECOS 9.3.x.x: 9.3.3.0 and below – <=9.3.3.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.