HPE patches 72 vulnerabilities in Aruba networking products

Hewlett Packard Enterprise (HPE) has released security patches to address 72 vulnerabilities within the AOS-8 and AOS-10 wireless operating systems used in its Aruba networking products. The update includes 33 critical-severity flaws and eight maximum-severity bugs.

Successful exploitation of these defects could allow unauthenticated attackers to achieve remote code execution (RCE), bypass authentication to gain administrative privileges, run arbitrary commands, and achieve complete system compromise. The vulnerabilities affect various hardware and mobility solutions, including mobility conductors, controllers, gateways, access points, and virtual machines compatible with the affected operating systems.

HPE recommends restricting CLI and web-based management interfaces to dedicated layer 2 segments or VLANs, and utilizing firewall policies at layer 3 and above to minimize exploitation risks.