CVE-2024-41136

Authenticated Command Injection in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface

HIGH

8.8

CVSS Score

Published: July 24, 2024 at 08:05 PM UTC

Updated: June 17, 2026 at 07:47 AM UTC

2 products affected across 2 vendorsEdgeconnect Sd WAN OrchestratorEdgeConnect SD-WAN Gateway

Using HPE Aruba Networking EdgeConnect SD-WAN by Hewlett Packard Enterprise (HPE)?

Get instant alerts when new vulnerabilities affect HPE Aruba Networking EdgeConnect SD-WAN - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 0.9%

SSVC

No known exploit

Description

An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Edgeconnect Sd WAN Orchestrator · Aruba Networks

95%

8.0.0 ≤ v < 8.0.19.0.0 ≤ v < 9.1.09.1.0 ≤ v ≤ 9.1.119.1.0 ≤ v ≤ 9.1.11.09.2.0 ≤ v ≤ 9.2.99.2.0 ≤ v ≤ 9.2.9.09.3.0 ≤ v ≤ 9.3.3.08.0.0 9.0.0 9.1.0 9.2.0 9.3.0

Affected range stops below 8.0.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.1.0, so it looks safe — our inference, not a vendor statement

EdgeConnect SD-WAN Gateway · Hewlett Packard Enterprise HPE

60%

ECOS 8.0.x.x: all builds are affected and are out of maintenance. ≤ v ≤ <=8.0.x.xECOS 9.0.x.x: all builds are affected and are out of maintenance. ≤ v ≤ <=9.0.x.xECOS 9.1.x.x: 9.1.11.0 and below ≤ v ≤ <=9.1.11.0ECOS 9.2.x.x: 9.2.9.0 and below ≤ v ≤ <=9.2.9.0ECOS 9.3.x.x: 9.3.3.0 and below ≤ v ≤ <=9.3.3.0ECOS 8.0.x.x: all builds are affected and are out of maintenance.ECOS 9.0.x.x: all builds are affected and are out of maintenance.