CVE-2025-37139

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-37139", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2025-04-16T01:28:25.368Z", "datePublished": "2025-10-14T16:58:14.200Z", "dateUpdated": "2025-10-14T19:25:30.743Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "ArubaOS (AOS)", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"lessThanOrEqual": "10.7.1.1", "status": "affected", "version": "10.7.0.0", "versionType": "semver"}, {"lessThanOrEqual": "10.4.1.8", "status": "affected", "version": "10.4.0.0", "versionType": "semver"}, {"lessThanOrEqual": "8.13.0.1", "status": "affected", "version": "8.13.0.0", "versionType": "semver"}, {"lessThanOrEqual": "8.12.0.5", "status": "affected", "version": "8.12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "8.10.0.18", "status": "affected", "version": "8.10.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Nicholas Starke"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successful exploitation may render the system unbootable, resulting in a Denial of Service that can only be resolved by replacing the affected hardware.</p>"}], "value": "A vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successful exploitation may render the system unbootable, resulting in a Denial of Service that can only be resolved by replacing the affected hardware."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2025-10-14T16:58:14.200Z"}, "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US"}], "source": {"advisory": "HPESBNW04957", "discovery": "INTERNAL"}, "title": "Vulnerability in AOS firmware allows for Authenticated Local malicious actor to Permanently Disable Boot", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T19:25:18.837412Z", "id": "CVE-2025-37139", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T19:25:30.743Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37139", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T19:25:18.837412Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T19:25:27.394Z"}}], "cna": {"title": "Vulnerability in AOS firmware allows for Authenticated Local malicious actor to Permanently Disable Boot", "source": {"advisory": "HPESBNW04957", "discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Nicholas Starke"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "ArubaOS (AOS)", "versions": [{"status": "affected", "version": "10.7.0.0", "versionType": "semver", "lessThanOrEqual": "10.7.1.1"}, {"status": "affected", "version": "10.4.0.0", "versionType": "semver", "lessThanOrEqual": "10.4.1.8"}, {"status": "affected", "version": "8.13.0.0", "versionType": "semver", "lessThanOrEqual": "8.13.0.1"}, {"status": "affected", "version": "8.12.0.0", "versionType": "semver", "lessThanOrEqual": "8.12.0.5"}, {"status": "affected", "version": "8.10.0.0", "versionType": "semver", "lessThanOrEqual": "8.10.0.18"}], "defaultStatus": "affected"}], "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successful exploitation may render the system unbootable, resulting in a Denial of Service that can only be resolved by replacing the affected hardware.", "supportingMedia": [{"type": "text/html", "value": "<p>A vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successful exploitation may render the system unbootable, resulting in a Denial of Service that can only be resolved by replacing the affected hardware.</p>", "base64": false}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2025-10-14T16:58:14.200Z"}}}, "cveMetadata": {"cveId": "CVE-2025-37139", "state": "PUBLISHED", "dateUpdated": "2025-10-14T19:25:30.743Z", "dateReserved": "2025-04-16T01:28:25.368Z", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "datePublished": "2025-10-14T16:58:14.200Z", "assignerShortName": "hpe"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "ArubaOS (AOS)", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"lessThanOrEqual": "10.7.1.1", "status": "affected", "version": "10.7.0.0", "versionType": "semver"}, {"lessThanOrEqual": "10.4.1.8", "status": "affected", "version": "10.4.0.0", "versionType": "semver"}, {"lessThanOrEqual": "8.13.0.1", "status": "affected", "version": "8.13.0.0", "versionType": "semver"}, {"lessThanOrEqual": "8.12.0.5", "status": "affected", "version": "8.12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "8.10.0.18", "status": "affected", "version": "8.10.0.0", "versionType": "semver"}]}], "source": "security-alert@hpe.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successful exploitation may render the system unbootable, resulting in a Denial of Service that can only be resolved by replacing the affected hardware."}, {"lang": "es", "value": "Una vulnerabilidad en un binario de firmware de AOS permite a un actor malicioso autenticado eliminar permanentemente informaci\u00f3n de arranque necesaria. La explotaci\u00f3n exitosa puede dejar el sistema inoperable, resultando en una denegaci\u00f3n de servicio que solo puede resolverse reemplazando el hardware afectado."}], "id": "CVE-2025-37139", "lastModified": "2026-10-08T12:10:00.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 4.0, "source": "security-alert@hpe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-37139", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-14T19:25:18.837412Z", "version": "2.0.3"}}]}, "published": "2025-10-14T17:15:40.697", "references": [{"source": "security-alert@hpe.com", "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04957en_us&docLocale=en_US"}], "sourceIdentifier": "security-alert@hpe.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"created": "2025-10-21T09:42:40.158722+00:00", "updated": "2025-10-21T09:42:40.158749+00:00", "vendors": ["hpe", "hpe$PRODUCT$arubaos"]}