Port ACL Functionality Vulnerability in HPE Aruba Networking CX 9300 Switch Series
CVE-2025-25040

3.3LOW

Key Information:

Vendor

HP (HP)

Status
Aos-cx
Vendor
CVE Published:
18 March 2025

What is CVE-2025-25040?

A vulnerability has been identified in the port ACL functionality of the AOS-CX software specifically on the HPE Aruba CX 9300 Switch Series. This issue allows attackers to bypass Access Control List (ACL) rules applied to routed ports during egress traffic, potentially enabling unauthorized data flow and infringing upon set security policies. Notably, Egress VLAN ACLs and Routed VLAN ACLs remain unaffected by this vulnerability. The risk is particularly critical for environments relying on robust routing and security measures.

Affected Version(s)

AOS-CX 10.14.0000

AOS-CX 10.14.0000

AOS-CX 10.15.0000

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Internal Engineering
.