CVE-2024-42394

🎯 CVE-2024-42394 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2024-42394 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

Klassifikation & Betroffenheit:

CWE-200 Hewlett Packard Enterprise (HPE) Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 Version 8.10.0.0: 8.10.0.12 and below ≤≤8.10.0.12Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 Version 8.10.0.0: 8.10.0.12 and below ≤≤8.10.0.12Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 Version 8.12.0.0: 8.12.0.1 and below ≤≤8.12.0.1Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 Version 8.12.0.0: 8.12.0.1 and below ≤≤8.12.0.1arubanetworks arubaos *hp instantos *

Exposure of Sensitive Information to an Unauthorized Actor 🎯 High

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

🛡️ Empfohlene Mitigation: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system de…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-13 · Subverting Environment Variable Values (Very High) CAPEC-22 · Exploiting Trust in Client (High) CAPEC-116 · Excavation (Medium) CAPEC-169 · Footprinting (Very Low) CAPEC-224 · Fingerprinting (Very Low) CAPEC-285 · ICMP Echo Request Ping (Low) CAPEC-287 · TCP SYN Scan (Low) CAPEC-290 · Enumerate Mail Exchange (MX) Records (Low)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1562.003 · Impair Defenses:Impair Command His… T1574.006 · Hijack Execution Flow:Dynamic Link… T1574.007 · Hijack Execution Flow:Path Interce… T1217 · Browser Bookmark Discovery T1592 · Gather Victim Host Information T1595 · Active Scanning

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-79851 10.0 CVE-2026-79850 10.0 CVE-2026-79849 10.0 CVE-2026-79848 10.0 CVE-2026-79847 10.0

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

🔗 support.hpe.com/hpesc/public/docDisplay

Ausnutzungs-Zeitleiste:

Reserviert 2024

Veröffentlicht 08/2024

Heute 02.11.

CVSS-Vektor-Analyse: 9.8

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA-Bewertung (hpe): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Veröffentlicht:06.08.2024

Aktualisiert:17.06.2026 07:49

Assigner (CNA):hpe

EUVD-ID:EUVD-2024-39598

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-200 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	754	0,2 %
≥50 %	3.338	0,9 %
≥10 %	22.175	5,7 %
<10 %	362.843	93,2 %

9.8 CRITICAL

EPSS

0.6%

CVE-2024-42394 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

Hewlett Packard Enterprise (HPE)

CVE-2024-42394 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

CWE-200 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 2 Jahren ↻ vor 2 Jahren

🛡️ Details ➔

CVE-2024-42394 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

Zero-Day & Vulnerability Intelligence Hub

CVE-2024-42394 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.