JoCERT Warns Of HPE Aruba Command Injection Flaws

This advisory reports two high-severity command injection vulnerabilities (CVE-2024-54006 and CVE-2024-54007) in HPE Aruba 501 Wireless Client Bridge firmware (≤ V2.1.1.0-B0030) that allow authenticated administrators to execute arbitrary commands; both are CVSS 7.2 and a public PoC exists — HPE recommends upgrading to V2.1.2.0-B0033 or later, restricting management access, auditing devices, and monitoring for suspicious activity.