Eight maximum-severity flaws affect AOS-8 and AOS-10 and require neither attacker privileges nor user interaction, according to HPE. The company urges customers to install the updates promptly.
Hewlett Packard Enterprise (HPE) has released ArubaOS security updates fixing 72 vulnerabilities, including eight rated at maximum severity, BleepingComputer reported on October 23. HPE urges customers to patch affected systems as soon as possible.
ArubaOS, also called AOS, runs enterprise wireless equipment, including access points, controllers and gateways. The eight maximum-severity flaws affect multiple versions of its AOS-8 and AOS-10 software lines.
According to HPE, as reported by BleepingComputer, remote attackers can exploit these flaws through low-complexity attacks without existing privileges or anyone interacting with the device. The flaws include authentication bypass, which defeats checks on who may access a system, and remote code execution, which lets an attacker run code on affected equipment.
The Canadian Centre for Cyber Security’s October 22 advisory lists the following affected versions. Each threshold applies to its corresponding release line.
| Release line | Versions listed as affected |
|---|---|
| AOS 10.8 | Earlier than 10.8.1.2 |
| AOS 10.7 | Earlier than 10.7.2.7 |
| AOS 10.4 | Earlier than 10.4.1.14 |
| AOS 8.13 | Earlier than 8.13.3.1 |
| AOS 8.10 | Earlier than 8.10.0.24 |
As of its advisory’s release, HPE said it had found no evidence of attacks exploiting these vulnerabilities and knew of no publicly available proof-of-concept exploit code, BleepingComputer reported.
To reduce the chance of exploitation, HPE recommends limiting access to command-line and web-based management interfaces to a dedicated local network segment, controlling access with firewall rules, or combining those measures. The company also recommends controls that track and log user activity and resource use.
HPE presents those access restrictions as mitigation measures while urging customers to install the security updates promptly. The Canadian Centre for Cyber Security also encourages users and administrators to review the advisory links and apply the necessary updates.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min
