CVE-2024-31470

The vulnerability results from a stack buffer overflow (CWE-121) in the SAE service handling the PAPI protocol — Aruba access point management protocol operating on UDP port 8211. An attacker can send specially crafted network packets directly to this port, triggering a buffer overflow and gaining control over the process execution flow. Exploitation does not require any authentication or user interaction, making it particularly dangerous in environments with network access to the management port.

Successful exploitation allows an attacker to execute arbitrary code with privileged user permissions at the operating system level of the device, resulting in complete takeover of the access point.

Apply patches available from the manufacturer in accordance with the following references: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us and https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt. As a temporary measure, it is recommended to restrict access to UDP port 8211 (PAPI) exclusively to trusted management hosts using a firewall or ACL lists.

Aruba ArubaOS and HP InstantOS — versions specified in manufacturer references (ARUBA-PSA-2024-006 and HPE Security Bulletin hpesbnw04647en_us)