CVE-2024-41136: An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation…

PriorityP260high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

0.86%

53.9th percentile

An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
arubanetworks	edgeconnect_sd-wan_orchestrator	—	—
arubanetworks	edgeconnect_sd-wan_orchestrator	—	—
arubanetworks	edgeconnect_sd-wan_orchestrator	—	—
arubanetworks	edgeconnect_sd-wan_orchestrator	9.1.0 – 9.1.11	—
arubanetworks	edgeconnect_sd-wan_orchestrator	9.2.0 – 9.2.9	—
hewlett_packard_enterprise	hpe_aruba_networking_edgeconnect_sd-wan	ECOS 8.0.x.x: all builds are affected and are out of maintenance. – <=8.0.x.x	—
hewlett_packard_enterprise	hpe_aruba_networking_edgeconnect_sd-wan	ECOS 9.0.x.x: all builds are affected and are out of maintenance. – <=9.0.x.x	—
hewlett_packard_enterprise	hpe_aruba_networking_edgeconnect_sd-wan	ECOS 9.1.x.x: 9.1.11.0 and below – <=9.1.11.0	—
hewlett_packard_enterprise	hpe_aruba_networking_edgeconnect_sd-wan	ECOS 9.2.x.x: 9.2.9.0 and below – <=9.2.9.0	—
hewlett_packard_enterprise	hpe_aruba_networking_edgeconnect_sd-wan	ECOS 9.3.x.x: 9.3.3.0 and below – <=9.3.3.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.