HPE patches eight max severity RCE and auth bypass AOS flaws

HPE patched 72 vulnerabilities in ArubaOS, with eight rated maximum severity due to authentication bypass and remote code execution risks. The affected software versions include multiple releases of AOS-8 and AOS-10. The vulnerabilities allow remote attackers to execute code or bypass authentication without privileges or user interaction. HPE advises immediate patching and recommends network segmentation and firewall controls for management interfaces. No proof-of-concept exploits or in-the-wild attacks are currently known.

Successful exploitation of these vulnerabilities could allow remote attackers to bypass authentication mechanisms and execute arbitrary code on affected ArubaOS devices. This could compromise enterprise wireless infrastructure components such as mobility conductors, access points, controllers, and gateways. The vulnerabilities pose a significant risk due to their maximum severity rating and ease of exploitation without user interaction. However, no active exploitation has been reported to date.

HPE has released official security updates to address these vulnerabilities. Customers are strongly urged to apply these patches as soon as possible. Additionally, HPE recommends restricting access to ArubaOS management interfaces by isolating them on dedicated layer 2 segments or VLANs and controlling access with firewall policies at layer 3 and above. Implementing accounting controls for user activity tracking and resource usage is also advised. Since the vendor has provided official fixes, patching is the primary mitigation.