CVE-2020-24633
Reported by hpe · Published December 11, 2020
There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending especially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211) of access-points or controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| arubaos | arubanetworks | 8.7.1.0, 8.6.0.6, 8.5.0.11, 8.3.0.14, 8.2.2.10, 6.5.4.18, 6.4.4.24 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | Aruba 9000 Gateway | 2.1.0.1, 2.2.0.0 and below |
| n/a | Aruba 7000 Series Mobility Controllers | 6.4.4.23, 6.5.4.17, 8.2.2.9 |
| n/a | Aruba 7200 Series Mobility Controllers | 6.4.4.23, 6.5.4.17, 8.2.2.9 |
| n/a | Aruba 7000 Series Mobility Controllers | 8.6.0.5, 8.7.0.0, 6.4.4.23 |
| n/a | Aruba 9000 Gateway | 2.1.0.1, 2.2.0.0 |
| n/a | Aruba 7200 Series Mobility Controllers | 8.7.0.0, 8.2.2.9, 8.5.0.10 |
Timeline
- Dec 11, 2020 CVE Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- Aug 4, 2024 CVE Updated
- Apr 4, 2026 Security Advisory
- Sep 2, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2020-24633
vulnetix vdb fixes CVE-2020-24633Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2020-24633/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart