CVE-2024-31468

An attacker sends specially crafted UDP packets to port 8211, which is handled by the PAPI protocol (Aruba Access Point management protocol). Improper handling of these packets by the Central Communications service leads to a stack-based buffer overflow (CWE-121). The vulnerability allows an attacker to take control of program execution flow without needing any credentials.

An attacker can execute arbitrary code with privileged user permissions at the operating system level of the device, which may lead to complete device compromise, loss of data confidentiality, system integrity, and availability.

Security patches available from the manufacturer should be applied in accordance with references — Aruba Networks security bulletin ARUBA-PSA-2024-006 and HPE bulletin hpesbnw04647en_us. Additionally, as a temporary measure, it is recommended to restrict access to UDP port 8211 (PAPI) exclusively to trusted hosts using firewall rules or network segmentation.

Devices running ArubaOS and HP InstantOS software — specific versions indicated in manufacturer references (ARUBA-PSA-2024-006 and HPE bulletin hpesbnw04647en_us)