Security Upgrades Available for 3 HPE Aruba Networking Bugs

Hewlett Packard Enterprise (Aruba Networking) disclosed and fixed three critical remote code execution vulnerabilities in the CLI service of Aruba access points (CVE-2024-42505 / CVE-2024-42506 / CVE-2024-42507) that can be triggered by sending packets to the AP management UDP port. Affected Instant AOS-8 and AOS-10 firmware versions are enumerated; HPE provides workarounds for some 8.x/AOS-10 devices but strongly recommends applying the supplied updates. HPE reports no known exploitation in the wild and no public exploit code at the time of the advisory.