CVE-2024-54010CWE-863broken-access-control

CVE-2024-54010

Low · published January 9, 2025

CVSS v3.1
3.4
EPSS
0%
Percentile
13.7
In the wild
Unconfirmed
What it is

A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to conduct a packet forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leading to unauthorized data exposure.

The record
Technical detail
CVSS v3.1
3.4 · LOW
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00235 · 13.7th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-01-09T02:15Z
Affected products (3)
ProductVersionsFixed in
hpe/arubaos-cx≥ 10.10.0000, < 10.13.107010.13.1070
hpe/arubaos-cx≥ 10.14.0000, < 10.14.103010.14.1030
hpe/arubaos-cx≥ 10.15.0000, < 10.15.100010.15.1000
References (2)
EPSS history
Timeline
  • 08 JAN 20:42Z
    Unauthenticated Traffic Handling Flaw Allows Packet Leakage on HPE Aruba Networking CX 10000 series switches
    cvelistv5