CVE-2024-31476

HIGH

8.8

CVSS Score

Published: May 14, 2024 at 10:31 PM UTC

Updated: June 17, 2026 at 07:28 AM UTC

5 products affected across 3 vendorsArubaosInstantInstantos

Using AOS-8 Instant and AOS-10 AP by Hewlett Packard Enterprise (HPE)?

Get instant alerts when new vulnerabilities affect AOS-8 Instant and AOS-10 AP - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 1%

SSVC

No known exploit

Description

Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Arubaos · Aruba Networks

95%

10.3.0.0 ≤ v < 10.4.0.010.3.0.0 ≤ v < 10.4.1.110.4.0.0 ≤ v ≤ 10.4.1.010.5.0.0 ≤ v ≤ 10.5.1.010.5.0.0 ≤ v < 10.5.1.110.3.0.0 10.4.0.0 10.5.0.0

Affected range stops below 10.4.0.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 10.4.1.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 10.5.1.1, so it looks safe — our inference, not a vendor statement

Instant · Aruba Networks

95%

6.4.0.0 ≤ v < 6.5.0.06.5.0.0 ≤ v < 6.6.0.08.10.0.0 ≤ v ≤ 8.10.0.108.11.0.0 ≤ v ≤ 8.11.2.18.4.0.0 ≤ v < 8.5.0.08.5.0.0 ≤ v < 8.6.0.08.6.0.0 ≤ v ≤ 8.6.0.238.7.0.0 ≤ v < 8.8.0.08.8.0.0 ≤ v < 8.9.0.08.9.0.0 ≤ v < 8.10.0.06.4.0.0 6.5.0.0 8.10.0.0 8.11.0.0 8.4.0.0 8.5.0.0 8.6.0.0 8.7.0.0 8.8.0.0 8.9.0.0

Affected range stops below 6.5.0.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.6.0.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.10.0.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.5.0.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.6.0.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.8.0.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.9.0.0, so it looks safe — our inference, not a vendor statement

Instantos · HP

95%

6.4.0.0 ≤ v < 8.6.0.248.7.0.0 ≤ v < 8.10.0.11

Affected range stops below 8.10.0.11, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.6.0.24, so it looks safe — our inference, not a vendor statement

Aruba InstantOS · Hewlett Packard Enterprise HPE

60%

10.4.0.0 ≤ v ≤ 10.4.1.010.5.0.0 ≤ v ≤ 10.5.1.08.10.0.0 ≤ v ≤ 8.10.0.108.11.0.0 ≤ v ≤ 8.11.2.18.6.0.0 ≤ v ≤ 8.6.0.2310.4.0.0 10.5.0.0 8.10.0.0 8.11.0.0 8.6.0.0

Arubaos · Hewlett Packard Enterprise HPE

60%

10.4.0.0 ≤ v ≤ 10.4.1.010.5.0.0 ≤ v ≤ 10.5.1.08.10.0.0 ≤ v ≤ 8.10.0.108.11.0.0 ≤ v ≤ 8.11.2.18.6.0.0 ≤ v ≤ 8.6.0.2310.4.0.0 10.5.0.0 8.10.0.0 8.11.0.0 8.6.0.0