External risk intelligence

ArubaOS and SD-WAN PAPI Unauthenticated Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-26305

The vulnerability affects ArubaOS and SD-WAN products and is triggered via the PAPI management protocol (UDP 8211). These devices frequently serve as network edge gateways and infrastructure management appliances, which are commonly deployed in internet-facing or inter-site routed positions, making them reachable in many network configurations.

Remote Code Execution

Arubanetworks Sd Wan

8.6.0.4-2.2.0.08.6.0.4-2.2.0.78.7.0.0-2.3.0.08.7.0.0-2.3.0.96.5.4.0 to before 8.10.0.128.11.0.0 to before 8.11.2.210.4.0.0 to before 10.4.1.110.5.0.0 to before 10.5.1.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability exists within the underlying Utility daemon in Aruba's network management technology. This flaw could permit unauthenticated attackers to execute arbitrary code remotely on affected devices, potentially gaining privileged access to the operating system. The primary concern is to confirm the relevance and exposure of this issue to our environment.

Unauthenticated remote code execution is possible.
Critical vulnerability impacts Aruba network management.
Assess exposure and confirm relevance to our environment.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a buffer overflow in the Aruba Utility daemon by sending specially crafted packets to the PAPI UDP port. This vulnerability does not require any special access or privileges to trigger, potentially allowing an attacker to execute arbitrary code as a privileged user on the device's operating system.

No authentication or privileges needed.
Specially crafted packets sent to UDP port.
Arbitrary code execution as a privileged user.

Live Threat

Current exploitation, exposure, and threat context

A buffer overflow in the underlying Utility daemon could allow an unauthenticated remote attacker to execute arbitrary code as a privileged user on the operating system by sending specially crafted packets to the PAPI UDP port. This could impact the integrity and availability of the affected systems.

System integrity and confidentiality.
Via specially crafted network packets.
Unauthorized privileged code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Aruba SD-WAN and ArubaOS, potentially allowing unauthenticated remote code execution. Infrastructure or platform teams are likely responsible for managing these devices. The immediate first step is to inventory all instances, confirm network reachability and business criticality, and identify the accountable owner for each.

Infrastructure teams own the issue.
Verify network exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the role of ArubaOS and SD-WAN software?

ArubaOS and SD-WAN are core technologies used to manage network infrastructure, including access points and edge gateways. These products handle complex traffic routing and device management, often serving as the central nervous system for large-scale enterprise network connectivity.

How does this buffer overflow vulnerability work?

This flaw is a CWE-121 stack-based buffer overflow. In plain terms, the system's Utility daemon fails to properly check the size of incoming data packets. By sending a specially crafted packet to a specific port, an attacker can overwrite memory, allowing them to force the device to run unauthorized, privileged commands.

Do I need to be authenticated to trigger CVE-2024-26305?

No, authentication is not required. The vulnerability is triggered externally by sending malicious packets to the PAPI protocol on UDP port 8211. Simply sending legitimate administrative traffic or normal network data will not trigger this issue; it requires the specific, malformed packet structure designed to overflow the daemon's memory.

How can I tell if my devices are reachable by attackers?

According to Halo Surface Signal, these devices frequently act as edge gateways. If your infrastructure is positioned to face the internet or is reachable across inter-site routed connections, it is likely accessible. You should verify if UDP port 8211 is open or reachable from outside your protected internal network segments.

What should I do first to address this risk?

Start by performing a comprehensive inventory of all ArubaOS and SD-WAN instances in your environment. Once identified, cross-reference these versions against the affected software list. Locate the primary system owner for each device to coordinate a verification of current network exposure and prepare for authorized updates.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.