CVE-2024-47461: Instant AOS Command Injection RCE Vulnerability

CVE-2024-47461 Overview

CVE-2024-47461 is an authenticated command injection vulnerability in the command line interface (CLI) of HPE Aruba Networking Instant AOS-8 and AOS-10. An authenticated attacker with high privileges can inject operating system commands through the CLI. Successful exploitation executes arbitrary commands as a privileged user on the underlying host. This results in full compromise of the underlying operating system running the Instant access point software. The vulnerability is tracked under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact
An authenticated attacker with administrative CLI access can execute arbitrary commands as a privileged user, resulting in complete compromise of the Instant AOS host operating system.

Affected Products

HPE Aruba Networking Instant AOS-8
HPE Aruba Networking Instant AOS-10
HPE Aruba Instant access points running affected firmware versions

Discovery Timeline

2024-11-05 - CVE-2024-47461 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47461

Vulnerability Analysis

The vulnerability resides in the CLI of Instant AOS-8 and AOS-10. The CLI accepts user-supplied input that is passed to an underlying shell or command execution context without sufficient neutralization of shell metacharacters. An authenticated administrator can craft CLI arguments that break out of the intended command context and execute arbitrary operating system commands. Because the CLI process runs with elevated privileges on the access point, injected commands execute as a privileged user on the underlying host operating system. This grants the attacker full control of the device, including firmware, configuration, and network traffic traversing the access point.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The CLI parser fails to sanitize or escape shell metacharacters before invoking underlying system commands. User-controlled input is concatenated into command strings rather than passed as separate arguments to a safe execution API.

Attack Vector

Exploitation requires network reachability to the CLI (SSH or console) and valid administrative credentials. The attack is remote but not unauthenticated. After logging in, the attacker issues a crafted CLI command containing shell metacharacters that redirect execution to attacker-chosen binaries or scripts. Full technical details are available in the HPE Aruba Security Advisory.

No verified public proof-of-concept code is available for this vulnerability. The vulnerability class involves passing unsanitized CLI arguments into shell command construction; see the vendor advisory for affected commands and versions.

Detection Methods for CVE-2024-47461

Indicators of Compromise

Unexpected shell processes spawned by CLI or management daemons on Instant AOS devices
CLI audit log entries containing shell metacharacters such as ;, |, &&, `, or $( in command arguments
Configuration changes, new local accounts, or firmware modifications made outside standard change windows
Outbound network connections from access points to non-management destinations

Detection Strategies

Enable and centrally collect CLI command auditing from all Instant AOS-8 and AOS-10 controllers and access points
Alert on administrative CLI sessions that include shell metacharacters in argument fields
Baseline normal administrative behavior and flag deviations such as off-hours logins or unusual source IP addresses
Correlate authentication events with subsequent configuration or firmware changes on the same device

Monitoring Recommendations

Forward TACACS+ and RADIUS authentication logs for Aruba management access to a central log platform for correlation
Monitor SNMP and syslog outputs from access points for process crashes, reboots, or unexpected daemon activity
Track integrity of firmware images and configuration files with scheduled comparisons against a known-good baseline

How to Mitigate CVE-2024-47461

Immediate Actions Required

Apply the fixed Instant AOS-8 and AOS-10 firmware versions listed in the HPE Aruba Security Advisory
Restrict CLI and management access to a dedicated management VLAN reachable only from trusted administrator hosts
Rotate administrative credentials on all Instant AOS devices and enforce unique per-device or centrally managed accounts
Review CLI audit logs for suspicious command patterns since the earliest possibly affected firmware was deployed

Patch Information

HPE Aruba Networking has published fixed firmware versions for Instant AOS-8 and AOS-10. Refer to the HPE Aruba Security Advisory for the specific fixed builds that address CVE-2024-47461 and apply them across all affected access points and virtual controllers.

Workarounds

Limit CLI access to a small set of authenticated administrators using role-based access control and per-command authorization through TACACS+
Disable remote CLI interfaces such as SSH on data-plane interfaces and expose management only on isolated networks
Require multi-factor authentication for all administrative access to Aruba infrastructure
Enforce the principle of least privilege so that day-to-day operations do not use accounts capable of reaching the vulnerable CLI commands

bash

# Example: restrict SSH management access on an Aruba Instant controller
# Replace <mgmt-subnet> and <admin-host> with your trusted management ranges
configure terminal
 mgmt-user admin root
 ssh mgmt-auth public-key
 restrict-mgmt-access
 mgmt-acl permit host <admin-host>
 mgmt-acl deny any
end
write memory