HPE Patches Eight Critical ArubaOS Flaws Enabling Unauthenticated Attacks

Hewlett Packard Enterprise has released updates for 72 vulnerabilities across its AOS-8 and AOS-10 wireless operating systems. Eight of these flaws are rated at the maximum CVSS score of 10.0 and can be reached over the network without authentication or user interaction. The affected products include Mobility Conductors, Controllers, Gateways, and access points. Several flaws could allow arbitrary command or code execution, while one authentication bypass in the PAPI component could grant administrator access and expose or alter sensitive data. Some of the vulnerabilities require additional conditions outside an attacker's control, and HPE has not publicly disclosed detailed exploitation specifics.