CVE-2024-54010

Unauthenticated Traffic Handling Flaw Allows Packet Leakage on HPE Aruba Networking CX 10000 series switches

LOW

3.4

CVSS Score

Published: January 8, 2025 at 08:42 PM UTC

Updated: September 22, 2026 at 08:11 PM UTC

9 products affected across 2 vendorsArubaos CxAruba Cx 10040 (S4R58A)Aruba Cx 10040 32P (S4R56A)

Using AOS-CX by Hewlett Packard Enterprise (HPE)?

Get instant alerts when new vulnerabilities affect AOS-CX - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

LOW3.4

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to conduct a packet forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leading to unauthorized data exposure.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Arubaos Cx · HPE

95%

10.10.0000 ≤ v < 10.13.107010.14.0000 ≤ v < 10.14.103010.15.0000 ≤ v < 10.15.1000

Affected range stops below 10.13.1070, so it looks safe — our inference, not a vendor statement

Affected range stops below 10.14.1030, so it looks safe — our inference, not a vendor statement

Affected range stops below 10.15.1000, so it looks safe — our inference, not a vendor statement

hpe-aruba-cx-10000-48y6c-r8p13a (environment) · hpe-aruba-cx-10000-48y6c-r8p14a (environment) · hpe-aruba-cx-10000-48y6c-s0f98a (environment) · hpe-aruba-cx-10040-32p-s4r54a (environment) · hpe-aruba-cx-10040-32p-s4r55a (environment) · hpe-aruba-cx-10040-32p-s4r56a (environment) · hpe-aruba-cx-10040-s4r58a (environment)

Arubaos Cx · Hewlett Packard Enterprise HPE

60%

Version 10.10.0000: 10.10.1140 and below ≤ v ≤ <=10.10.1140Version 10.13.0000: 10.13.1060 and below ≤ v ≤ <=10.13.1060Version 10.14.0000: 10.14.1020 and below ≤ v ≤ <=10.14.1020Version 10.15.0000: 10.15.0005 and below ≤ v ≤ <=10.15.0005

Aruba Cx 10000-48Y6C (R8P13A)· HPEdevice

80%

All versions

Aruba Cx 10000-48Y6C (R8P14A)· HPEdevice

80%

All versions

Aruba Cx 10000-48Y6C (S0F98A)· HPEdevice

80%

All versions

Aruba Cx 10040 32P (S4R54A)· HPEdevice

80%

All versions