CVE-2024-54006
Published: 07 January 2025
Description
Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute arbitrary commands as a privileged user on the underlying operating system. Exploitation requires administrative authentication credentials on the host system.
Security Summary
CVE-2024-54006 involves multiple command injection vulnerabilities (CWE-77) in the web interface of the 501 Wireless Client Bridge. These flaws allow authenticated remote command execution, enabling attackers to run arbitrary commands as a privileged user on the underlying operating system. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts.
Exploitation requires network access and administrative authentication credentials on the affected host (PR:H). An attacker with valid admin privileges could leverage the web interface to inject malicious commands, achieving full remote code execution as a privileged user. This could lead to complete system compromise, including data exfiltration, persistence, or further lateral movement within the network.
The HPE security bulletin (hpesbnw04763en_us) provides details on the issue; practitioners should consult it for patch availability and mitigation guidance.
Details
- CWE(s)