CVE-2024-42505
CriticalSummary
W podatności CVE-2024-42505 występują luki w wstrzykiwaniu poleceń w usłudze CLI, które mogą prowadzić do zdalnego wykonania kodu bez uwierzytelnienia poprzez wysyłanie specjalnie przygotowanych pakietów do portu UDP PAPI (protokół zarządzania punktami dostępowymi Aruba). Sukces w wykorzystaniu tych luk pozwala na wykonanie dowolnego kodu jako użytkownik z uprawnieniami na systemie operacyjnym.
Risk Assessment
Organizacje mogą być narażone na poważne zagrożenia związane z bezpieczeństwem, ponieważ atakujący mogą uzyskać dostęp do systemu operacyjnego i wykonywać nieautoryzowane operacje. To może prowadzić do utraty danych, naruszenia prywatności oraz innych poważnych konsekwencji.
Recommendation
Zaleca się natychmiastowe zaktualizowanie oprogramowania do najnowszej wersji, która usuwa te luki, oraz wdrożenie odpowiednich środków zabezpieczających, takich jak ograniczenie dostępu do portu UDP 8211.
Related vulnerabilities
- CVE-2026-79687Critical
Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could exploit this, leading to filesystem access.
- CVE-2026-18931Critical
Use of Hard-coded Credentials vulnerability in Talassoft Industrial Management Software allows retrieval of embedded sensitive data. Affects versions from V.4 before V.16.
- CVE-2026-78012Critical
An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Class 3 explicit-message request to exceed the application-side receive buffer without error. This could result in memory corruption, device crash, or remote attack vector.
- CVE-2026-9621Critical
A denial-of-service issue exists in RSLinx Classic due to improper handling of a malformed packet. A crafted CIP packet can crash the service, requiring restart.
- CVE-2026-18808Critical
Improper Control of Generation of Code ('Code Injection') vulnerability in KIO (Klemsan Internet Objects) allows code injection. Affects versions before v1.9.
- CVE-2026-18210Critical
Improper neutralization of special elements in an SQL command ('SQL injection') vulnerability in Products's Store allows SQL injection. Affects versions before 030631b2.
- CVE-2026-84149Critical
This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated attacker could retrieve repository metadata and files, potentially reconstructing the application's source code.
- CVE-2026-84148Critical
This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated attacker could manipulate parameters, leading to exposure of sensitive information of other users.
- CVE-2026-84147Critical
This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated attacker could upload arbitrary files to a web accessible directory, potentially executing arbitrary code and compromising the system.
- CVE-2026-84121Critical
Sandbox escape vulnerability due to use-after-free in the DOM: Security component. Fixed in Firefox 155, Firefox ESR 115.40, 140.15, and 153.2.
Original NVD description (English source)
Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.