What’s Vulnerable › Vulnerabilities

CVE-2024-54010: Unauthenticated Traffic Handling Flaw Allows Packet Leakage on HPE Aruba Networking CX 10000 series switches

• Severity: low (CVSS 3.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-08 · updated 2026-09-22
• Weakness: CWE-863

Description

A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to conduct a packet forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leading to unauthorized data exposure.

Affected products

• Hewlett Packard Enterprise (HPE) AOS-CX: from 10.10.0000 before 10.13.1070; from 10.14.0000 before 10.14.1030; from 10.15.0000 before 10.15.1000 — fixed in 10.13.1070, 10.14.1030, 10.15.1000

How to fix

Upgrade to a fixed version: Hewlett Packard Enterprise (HPE) AOS-CX 10.13.1070, 10.14.1030, 10.15.1000. Check the vendor advisory for mitigations.

References

• https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04772.txt
• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04772en_us&docLocale=en_US

Get alerted when CVE-2024-54010 or the next vulnerability affects your stack