CVE-2025-37123

Authenticated Command Injection leads to Unauthorized Actions in CLI Interface

A vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on the underlying operating system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hp

Products

Edgeconnect Enterprise Arubaos

CVE-2025-37184

Unauthenticated Bypass Allows Multi-Factor Authentication Circumvention

A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Successful exploitation could allow an attacker to create an admin user account without the necessary multi-factor authentication, thereby compromising the integrity of secured access to the system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Orchestrator

CVE-2025-27082

Authenticated Remote Code Execution Vulnerabilities in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface via Arbitrary File Write

Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlying host operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks

Products

Arubaos

CVE-2025-37132

Authenticated Remote Code Execution Vulnerability in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface via Arbitrary File Write

An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files and execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

Arubaos Arubaos

CVE-2025-37133

Authenticated Command Injection Vulnerability in AOS-8 Controller/Mobility Conductor Web-Based Management Interface via the CLI Binaryalong with accounting controls for tracking and logging user activities and resource usage.

An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

Arubaos Arubaos

CVE-2025-37134

Authenticated Command Injection Vulnerability in the Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface

An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

Arubaos Arubaos

CVE-2025-37163

Authenticated Command Injection Vulnerability in HPE Aruba Networking Management Software (AirWave) CLI

A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authenticated attacker could exploit this vulnerability to execute arbitrary operating system commands with elevated privileges on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

Airwave Aruba Airwave

CVE-2025-37170

Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface

Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

Arubaos Arubaos

CVE-2025-37171

Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface

Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

Arubaos Arubaos

CVE-2025-37172

Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface

Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

Arubaos Arubaos

CVE-2025-37173

Improper Input Handling Vulnerability in Authenticated Configuration API Endpoint (AOS-10/AOS-8 Web UI)

An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor with valid credentials to trigger unintended behavior on the affected system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hp Hpe

Products

Arubaos Arubaos Arubaos

CVE-2025-37174

Authenticated Arbitrary File Write Vulnerability in AOS 10 and AOS-8 Web-Based Management Interface

Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to create or modify arbitrary files and execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

Arubaos Arubaos

CVE-2025-37175

Authenticated Arbitrary File Upload Vulnerability in AOS-10 or AOS-8 Web-Based Management Interface

Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files as a privilege user and execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hp Hpe

Products

Arubaos Arubaos Arubaos

CVE-2025-37176

Authenticated Command Injection Vulnerability in an AOS-8 operating system's internal workflow

A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. Successful exploit could allow an authenticated malicious actor to execute commands with the privileges of the impacted mechanism.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Arubanetworks Hp Hpe

Products

Arubaos Arubaos Arubaos

CVE-2025-37161

Unauthenticated Remote Denial-of-Service (DoS) Vulnerability in Web Management Interface

A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

Arubaos Aruba Networking 100 Series Cellular Bridge

CVE-2025-37162

Authenticated Command Injection Vulnerability Leading to Arbitrary Remote Command Execution

A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

Arubaos Aruba Networking 100 Series Cellular Bridge

CVE-2025-37177

Authenticated Arbitrary File Deletion Vulnerability in AOS-10 or AOS-8 Command Line Interface (CLI)

An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation of this vulnerability could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hp Hpe

Products

Arubaos Arubaos Arubaos

CVE-2025-37178

Out-of-Bounds Read Vulnerabilities Leading to Process Crash in AOS-8 Operating System

Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. Under specific conditions, this can result in a crash of the affected process and a potential denial-of-service of the compromised process.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hp Hpe

Products

Arubaos Arubaos Arubaos

CVE-2025-37179

Out-of-Bounds Read Vulnerabilities Leading to Process Crash in AOS-8 Operating System

Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. Under specific conditions, this can result in a crash of the affected process and a potential denial-of-service of the compromised process.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hp Hpe

Products

Arubaos Arubaos Arubaos

CVE-2025-37168

Unauthenticated Arbitrary File Deletion Vulnerability in AOS-8 Operating System

Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation of this vulnerability could allow an unauthenticated remote malicious actor to delete arbitrary files within the affected system and potentially result in denial-of-service conditions on affected devices.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hp Hpe

Products

Arubaos Arubaos Arubaos