CVE-2020-24637
CVE-2020-24637 is a high-severity vulnerability in Arubanetworks Sd-wan with a CVSS 3.x base score of 7.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 3.x base score 7.2)
- CVSS v2: 9.0
- EPSS exploit prediction: 2% (72nd percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Arubanetworks Sd-wan
- Published:
- Last modified:
Description
Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerability this could lead to remote compromise of system integrity by allowing an attacker to load an untrusted or modified kernel in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below.
Frequently asked questions
- What is CVE-2020-24637?
- Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. Successful exploitation of this vulnerability this could lead to remote compromise of system integrity by allowing an attacker to load an untrusted or modified kernel in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below.
- How severe is CVE-2020-24637?
- CVE-2020-24637 has a CVSS 3.x base score of 7.2, rated high severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2020-24637 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (72nd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2020-24637?
- CVE-2020-24637 primarily affects Arubanetworks Sd-wan. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2020-24637?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2020-24637 published?
- CVE-2020-24637 was published on 2020-12-11 and last updated on 2026-06-17.
References
Affected products (2)
- cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
- cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*
More vulnerabilities in Arubanetworks Sd-wan
- CVE-2023-22752 — Critical (CVSS 9.8): There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by…
- CVE-2023-22751 — Critical (CVSS 9.8): There are stack-based buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by…
- CVE-2023-22750 — Critical (CVSS 9.8): There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by…
- CVE-2023-22749 — Critical (CVSS 9.8): There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by…
- CVE-2023-22748 — Critical (CVSS 9.8): There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by…
- CVE-2023-22747 — Critical (CVSS 9.8): There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by…