SB2025021046 - Multiple vulnerabilities in HPE Athonet Core
Published: February 10, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2024-24452)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when handling the ProtocolIE_ID field of E-RAB Release Indication messages in Athonet vEPC MME. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.
2) Buffer overflow (CVE-ID: CVE-2024-24453)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when handling the ProtocolIE_ID field of E-RAB NotToBeModifiedBearerModInd information element in Athonet vEPC MME. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.
3) Buffer overflow (CVE-ID: CVE-2024-24454)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when handling the ProtocolIE_ID field of E-RAB Modify Request messages in Athonet vEPC MME. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.
4) Buffer overflow (CVE-ID: CVE-2024-24455)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when handling a UE Context Release message containing an invalid UE identifier in Athonet vEPC MME. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.
5) Buffer overflow (CVE-ID: CVE-2024-24456)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when handling the E-RAB Release Command NAS PDU in Athonet MME. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.
6) Buffer overflow (CVE-ID: CVE-2024-24457)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when handling the ProtocolIE_ID field of E-RAB Setup List Context SURes messages in Athonet vEPC MME. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.
7) Buffer overflow (CVE-ID: CVE-2024-24458)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when handling the ENB Configuration Transfer messages containing invalid PLMN Identities in Athonet vEPC MME. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.
8) Buffer overflow (CVE-ID: CVE-2024-24459)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when handling the ProtocolIE_ID field of S1Setup Request messages in Athonet vEPC MME. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.