Arubaos Cx
CVE-2024-54010
LOW
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS score of 3.4 (LOW). Attack characteristics: adjacent network attack vector, high complexity, no privileges required, no user interaction not required. EPSS exploitation probability: 0.01%. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to bypass authorization checks to access restricted resources. No authentication is required to exploit this vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. Rated low severity (CVSS 3.4), this vulnerability is no authentication required. No vendor patch available.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and test authorization logic, implement consistent access control checks, use centralized authorization framework.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as Incorrect Authorization (CWE-863), which allows attackers to bypass authorization checks to access restricted resources. A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to conduct a packet forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leading to unauthorized data exposure.
Know when Arubaos Cx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionNVD
A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to conduct a packet forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leading to unauthorized data exposure.
Executive ViewAI
CVE-2024-54010 is a low-severity vulnerability (CVSS 3.4). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
More in Arubaos Cx
View allAuth bypass in HPE Aruba AOS-CX switch web management.
Authenticated remote attackers holding low-privilege management access to HPE Aruba Networking AOS-CX switches can injec
Authenticated command injection in HPE ArubaOS-CX allows a remote attacker who already holds valid management credential
Authenticated remote attackers can execute arbitrary commands through malformed parameters in AOS-CX CLI commands, achie
OS command injection in the CLI of HPE Aruba Networking AOS-CX switches (CWE-78) lets an authenticated remote attacker w
An authenticated command injection vulnerability exists in the AOS-CX command line interface. Rated high severity (CVSS
An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Rated high severity
A vulnerability in the SSH restricted shell interface of the network management services allows improper access control
ArubaOS-CX web management interface session fixation allows an authenticated remote attacker with low-privilege credenti
Authenticated administrators of AOS-CX Switches can inject arbitrary commands through a custom binary in the CLI, potent
A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Rated medium severity (CVSS 6.8),
A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote at
GitHub PoC
Exploit-DB