CVE-2025-37155

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-37155", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "state": "PUBLISHED", "assignerShortName": "hpe", "dateReserved": "2025-04-16T01:28:25.369Z", "datePublished": "2025-11-18T18:40:40.560Z", "dateUpdated": "2026-02-26T16:21:10.275Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "HPE Aruba Networking AOS-CX", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"lessThanOrEqual": "10.16.1000", "status": "affected", "version": "10.16.0000", "versionType": "semver"}, {"lessThanOrEqual": "10.15.1020", "status": "affected", "version": "10.15.0000", "versionType": "semver"}, {"lessThanOrEqual": "10.14.1050", "status": "affected", "version": "10.14.0000", "versionType": "semver"}, {"lessThanOrEqual": "10.13.1090", "status": "affected", "version": "10.13.0000", "versionType": "semver"}, {"lessThanOrEqual": "10.10.1160", "status": "affected", "version": "10.10.0000", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Angelo Catalani"}, {"lang": "en", "type": "reporter", "value": "Giacomo Gloria"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If successfully exploited, this vulnerability could allow an attacker with read-only privileges to gain administrator access on the affected system.</p>"}], "value": "A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If successfully exploited, this vulnerability could allow an attacker with read-only privileges to gain administrator access on the affected system."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2025-11-18T18:40:40.560Z"}, "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US"}], "source": {"advisory": "HPESBNW04888", "discovery": "EXTERNAL"}, "title": "Authenticated Privilege Escalation Allows Unauthorized Access in Network Management Interface", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37155", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-19T04:55:36.998458Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T16:21:10.275Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37155", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-19T04:55:36.998458Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T20:12:12.671Z"}}], "cna": {"title": "Authenticated Privilege Escalation Allows Unauthorized Access in Network Management Interface", "source": {"advisory": "HPESBNW04888", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Angelo Catalani"}, {"lang": "en", "type": "reporter", "value": "Giacomo Gloria"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "HPE Aruba Networking AOS-CX", "versions": [{"status": "affected", "version": "10.16.0000", "versionType": "semver", "lessThanOrEqual": "10.16.1000"}, {"status": "affected", "version": "10.15.0000", "versionType": "semver", "lessThanOrEqual": "10.15.1020"}, {"status": "affected", "version": "10.14.0000", "versionType": "semver", "lessThanOrEqual": "10.14.1050"}, {"status": "affected", "version": "10.13.0000", "versionType": "semver", "lessThanOrEqual": "10.13.1090"}, {"status": "affected", "version": "10.10.0000", "versionType": "semver", "lessThanOrEqual": "10.10.1160"}], "defaultStatus": "affected"}], "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If successfully exploited, this vulnerability could allow an attacker with read-only privileges to gain administrator access on the affected system.", "supportingMedia": [{"type": "text/html", "value": "<p>A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If successfully exploited, this vulnerability could allow an attacker with read-only privileges to gain administrator access on the affected system.</p>", "base64": false}]}], "providerMetadata": {"orgId": "eb103674-0d28-4225-80f8-39fb86215de0", "shortName": "hpe", "dateUpdated": "2025-11-18T18:40:40.560Z"}}}, "cveMetadata": {"cveId": "CVE-2025-37155", "state": "PUBLISHED", "dateUpdated": "2026-02-26T16:21:10.275Z", "dateReserved": "2025-04-16T01:28:25.369Z", "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0", "datePublished": "2025-11-18T18:40:40.560Z", "assignerShortName": "hpe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "HPE Aruba Networking AOS-CX", "vendor": "Hewlett Packard Enterprise (HPE)", "versions": [{"lessThanOrEqual": "10.16.1000", "status": "affected", "version": "10.16.0000", "versionType": "semver"}, {"lessThanOrEqual": "10.15.1020", "status": "affected", "version": "10.15.0000", "versionType": "semver"}, {"lessThanOrEqual": "10.14.1050", "status": "affected", "version": "10.14.0000", "versionType": "semver"}, {"lessThanOrEqual": "10.13.1090", "status": "affected", "version": "10.13.0000", "versionType": "semver"}, {"lessThanOrEqual": "10.10.1160", "status": "affected", "version": "10.10.0000", "versionType": "semver"}]}], "source": "security-alert@hpe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", "matchCriteriaId": "3FEB3830-A052-4585-BF45-9E221FA06D43", "versionEndExcluding": "10.10.1170", "versionStartIncluding": "10.10.0000", "vulnerable": true}, {"criteria": "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", "matchCriteriaId": "0490B2CA-4273-426E-8776-814D242834B0", "versionEndExcluding": "10.13.1101", "versionStartIncluding": "10.13.0000", "vulnerable": true}, {"criteria": "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", "matchCriteriaId": "21AC81E3-A4C8-4120-AEEA-46123B84A250", "versionEndExcluding": "10.14.1060", "versionStartIncluding": "10.14.0000", "vulnerable": true}, {"criteria": "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", "matchCriteriaId": "FB5ADE5E-72CB-41E0-B7A0-08BEBB94ED8E", "versionEndExcluding": "10.15.1030", "versionStartIncluding": "10.15.0000", "vulnerable": true}, {"criteria": "cpe:2.3:o:hpe:arubaos-cx:*:*:*:*:*:*:*:*", "matchCriteriaId": "5CF58D01-F13F-4DAF-B6A1-D91AEC7F19B3", "versionEndExcluding": "10.16.1001", "versionStartIncluding": "10.16.0000", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If successfully exploited, this vulnerability could allow an attacker with read-only privileges to gain administrator access on the affected system."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de shell restringido de SSH de los servicios de gesti\u00f3n de red permite un control de acceso inadecuado para usuarios autenticados de solo lectura. Si se explota con \u00e9xito, esta vulnerabilidad podr\u00eda permitir a un atacante con privilegios de solo lectura obtener acceso de administrador en el sistema afectado."}], "id": "CVE-2025-37155", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-alert@hpe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-37155", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-19T04:55:36.998458Z", "version": "2.0.3"}}]}, "published": "2025-11-18T19:15:47.170", "references": [{"source": "security-alert@hpe.com", "tags": ["Vendor Advisory"], "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04888en_us&docLocale=en_US"}], "sourceIdentifier": "security-alert@hpe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"created": "2025-11-24T09:10:23.098720+00:00", "updated": "2025-11-24T09:10:23.098747+00:00", "vendors": ["hpe", "hpe$PRODUCT$arubaos-cx"]}