← Back

CVE-2025-37134

nvd nist
Published: Oct 14, 2025Modified: Jun 17, 2026

JSON object

Loading...
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: security-alert@hpe.com (Secondary)

Description

An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system.

Affected (5)

Arubanetworks
1 product
Arubaos
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Arubanetworks
Arubaos
From 10.4.0.0 to 10.4.1.9
Arubaos
From 10.7.0.0 to 10.7.2.1
Arubaos
From 8.10.0.0 to 8.10.0.19
Arubaos
From 8.12.0.0 to 8.12.0.6
Arubaos
From 8.13.0.0 to 8.13.1.0

Related CWEs

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (1)

Source: security-alert@hpe.com
Vendor Advisory

Timeline

No history available yet.