Cisco disclosed four Snort 3 vulnerabilities across seven products, while HPE released updates for 72 ArubaOS flaws, including eight maximum-severity authentication-bypass and code-execution issues, BleepingComputer reports. Cisco rated two flaws critical and two high.
Cisco links two critical flaw groups to out-of-bounds memory writes and incorrect calculations, but provides too little detail to establish individual exploit paths. Its advisory lists corrected branches for Open Source Snort 3, Cyber Vision, FTD and IOS XE UTD; Cisco says CDFW, Secure Access and Dashboard-connected Meraki devices received fixes automatically. The supplied HPE report does not identify corrected ArubaOS versions.
Cisco’s scope statement also conflicts with the earlier FTD-specific account, which tied exposure to Snort 3 and intrusion-policy settings. For teams running these products, the coverage leaves two different gaps: FTD exposure cannot be resolved from the conflicting statements, and the HPE excerpt does not establish which ArubaOS release closes the reported flaws.
8 sources · 4h ago
CVEs in this update
10 CVEs
Across Simple Inventory System, ArubaOS, Unknown product, and related packages.
HPE patches eight max severity RCE and auth bypass AOS flaws
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues.