There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending especially crafted…

Description

There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending especially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211) of access-points or controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below.

Scores

EPSS (exploitation in 30 days)

5.1% · top 7.6% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

• remote buffer overflow
• CWE-120 (opens in a new tab)All about CWE-120 and its CVEs

Affected products

• Aruba 9000 Gateway

  • affected 2.1.0.1
  • affected 2.2.0.0 and below

• Aruba 7000 Series Mobility Controllers

  • affected 6.4.4.23
  • affected 6.5.4.17
  • affected 8.2.2.9
  • affected 8.3.0.13
  • affected 8.5.0.10
  • affected 8.6.0.5
  • affected 8.7.0.0 and below

• Aruba 7200 Series Mobility Controllers

  • affected 6.4.4.23
  • affected 6.5.4.17
  • affected 8.2.2.9
  • affected 8.3.0.13
  • affected 8.5.0.10
  • affected 8.6.0.5
  • affected 8.7.0.0 and below

References (1)

• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04072en_us (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2020-24633](https://trackcve.app/badge/CVE-2020-24633.svg)](https://trackcve.app/cve/CVE-2020-24633)

Record last updated 4 Aug 2024, 15:19 UTC.