HPE Aruba AOS-8 AP Multiple Vulnerabilities Advisory (CVE-2020-7346/7347/7348)

Critical Vulnerability Information Vulnerability Overview Title: HPE Aruba Networking AOS 8 Instant AP and AOS-8 AP Multiple Vulnerabilities Type: Multiple vulnerabilities, including remote code execution, denial of service, and unauthorized access. Severity: High Affected Products Affected Products: - AOS-8 Instant AP - AOS-8 Access Points Vulnerability Details 1. CVE-2020-7346: Unauthorized Remote Code Execution - Description: A vulnerability exists in the AOS-8 Instant management configuration server that allows unauthorized users to execute arbitrary commands on the system via specially crafted HTTP requests. - CVSS Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - Remediation Recommendation: Upgrade to the latest version. 2. CVE-2020-7347: Secure Boot Bypass for Compromise of Hardware Root of Trust - Description: Affected accounts can bypass the secure boot mechanism and replace existing firmware with unsigned firmware images. - CVSS Score: 7.4 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) - Remediation Recommendation: Upgrade to the latest version and enable secure boot functionality. 3. CVE-2020-7348: Kernel Panic triggered by Malformed Ethernet Frames leads to Denial of Service Vulnerability - Description: A kernel panic vulnerability exists during the parsing of malformed Ethernet frames, leading to a denial of service. - CVSS Score: 5.5 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - Remediation Recommendation: Upgrade to the latest version. Supported Software Versions Lists specific AOS-8 versions and associated product models affected. Solutions Provides update guidance and contact information for third-party security vendors. ``` This summary outlines key vulnerability details, affected products, CVSS scores, and remediation recommendations.

Goal Reached Thanks to every supporter — we hit 100%!

HPE Aruba AOS-8 AP Multiple Vulnerabilities Advisory (CVE-2020-7346/7347/7348)