Overview
Hewlett Packard Enterprise (HPE) Aruba Networking has released an advisory detailing five vulnerabilities impacting Aruba Access Points (APs) that operate on Instant AOS (ArubaOS) versions 8 and 10. ArubaOS is a distributed network operating system that, in conjunction with Aruba Central, manages APs and optional gateways.
Among these vulnerabilities are two critical command injection flaws and three high-severity issues, which, if exploited, could allow an attacker to perform remote code execution (RCE). A successful exploit would enable the attacker to run arbitrary code with elevated privileges on the underlying operating system.
Zoom has issued updates to fix several high-severity vulnerabilities in its products, including issues that could lead to information disclosure and privilege escalation. Among the addressed flaws is CVE-2024-29008, impacting Zoom Rooms and Zoom On-Premise Meeting Connector MMR, which could allow an attacker with network access to execute arbitrary code. Zoom recommends that users apply the latest patches to ensure protection.
Red Hat has released a security advisory, RHSA-2024:1674, addressing multiple vulnerabilities across various packages. These include critical vulnerabilities affecting the Red Hat Enterprise Linux (RHEL) ecosystem, which could lead to potential impacts on system integrity, confidentiality, and availability. Among these issues, some vulnerabilities could allow for privilege escalation, unauthorised access, and remote code execution, impacting the security of affected systems.
Dell has released a security update, DSA-2024-449, addressing critical vulnerabilities in Dell Enterprise SONiC OS versions 4.1.x and 4.2.x. These include command injection (CVE-2024-45763 and CVE-2024-45765) and an authentication bypass flaw (CVE-2024-45764), which could allow remote attackers with varying privileges to execute commands or bypass protections.
Citrix has reported two high-severity vulnerabilities that affect the NetScaler ADC and NetScaler Gateway Security Bulletin.
- CVE-2024-8534 is a memory safety vulnerability leading to memory corruption and Denial of Service
- CVE-2024-8535 can allow authenticated user can access unintended user capabilities
Microsoft Microsoft’s November 2024 Patch Tuesday update addresses 89 vulnerabilities across multiple products, including Windows, Office, Azure, .NET, Hyper-V, and SQL Server. The update includes four critical and 84 important fixes, with two actively exploited zero-day vulnerabilities:
- CVE-2024-43451, an NTLM hash disclosure in MSHTML, and
- CVE-2024-49039, a Windows Task Scheduler privilege escalation flaw.
Additionally, CVE-2024-43602 is a critical remote code execution issue in Azure CycleCloud with a CVSS score of 9.9.
Recommended Action
Organisations are encouraged to review the appropriate security advisory pages and apply the updates:
HPE Aruba Networking – Security Bulletin
Zoom – Security Bulletin
Red Hat – Security Advisory
Dell – Support
Citrix – Security Bulletin
Microsoft – Update Guide
If you have any concerns, or have been affected by a cyber-related issue, report it to us by submitting a Cyber Concerns Online Reporting Form.